move record decryption to crypton.work (probably in a worker)