switched to cbc for internal password encryption due to complexity of nonce generation.  all tests pass.