Fix description/design of AEAD API.

With SIV (RFC5297), decryption can only start when the MAC is known.
The AEAD API does not support that.

In this proposal, for SIV the MAC is exceptionally passed together
with the ciphertext to the decrypt() method.