constrain cryptocipher < 0.4.0

cryptocipher 0.4.0 re-exports from the new(?) package cipher-aes which
breaks API compatibility resulting in: "Not in scope: type constructor
 or class `A.AES256'"