Change default cipher specification

new default is "aes-xts-plain64:sha256"
manpage now includes note on how to tune it
fixes #102