don't put AES 256 CBC over AES 128 GCM by default