Reordered auth_send a bit for clarity.
Refactoring: Do HMAC verification and decryption in separate methods.
Nicer __repr__ + log messages for next_payload.