for reasons unknown to me, the encryption scheme (CBC) failed to work.  changing to GCM, however, set it back to right.

also minor npe fixes