To explain my previous comment. A more difficult to tamper with system could be:

1. Hash the password with a salted sha256 to generate the the key used for symmetric encryption. This would require a 3rd optional argument that if left null would default to `Security.salt`.
2. Combine the cipher text and iv for decryption later.
3. Use the key generated in step 1 to generate a sha256 HMAC of the cipher text created in step 2.
4. Return the combined HMAC + cipher text.

Decryption would use a similar approach checking the HMAC to ensure the encrypted data is actually ours.