rewrite CBC unpad without data-dependent branches, mitigates lucky 13 (still needed: hmac computation with constant time in both success and failure mode)