Always throw a 403 error on secure string decode.

Sometimes a bad password won’t error, but return junk data. Even through this won’t result in a security hole, it’s hard to differentiate between a failed decryption and an unsuccessful that returned bad data.
Add some doc comments.
Remove pnormaldist().
Remove assertExact() in favour of PHPUnit’s assertSame().
Use .xml instead of .json so that the request returns the proper response.
Add a controller into readme’s code sample to show the great functionality that we have.