Added test and fix to prevent accidental double encryption.

Encrypted values may get passed around if they're copied as nested objects. Rather than forcing the user to decrypt them before copying (like the case of password migration), it makes more sense to never encrypt  an already-encrypted value.