whew! AEAD encrypt / decrypt-with-valid both work