use an authenticated cipher mode by default [FIXED PULL]

Use id-aes256-GCM by default instead of aes-256-cbc. This ensures that commits modifying the file without using the correct password will be detected.