raise fatal alert if Finished verification fails
bugfix: check epoch of received handshake messages

This fixes a bug found by Lars and Jens where the server has accepted
Finish messages with wrong security parameters.
Merge remote-tracking branch 'olaf/master'