Cookie padding / encryption
Keep keys/IV internal, return an object