Update security to reflect latest model

Switch from AES-CBC-HMAC to AES-GCM. Dropping password support in favor
of only keys, and removing use of PBKDF2.