AES-GCM allows the caller to supply additional authenticated data (AAD) -- data that is only authenticated but not encrypted. However NaCl's authenticated encryption mode doesn't seem to provide anything like this: http://nacl.cr.yp.to/secretbox.html

So when I have AAD, what should I do when using NaCl? Add it as part of the message to crypto_secretbox(), or should I authenticate this data separately?