CCM-AES "associated auth data" is optional, and we no longer
set it to 16 bytes of zeros. Now we don't use associated at all.