protocol: better change cipher handling