Bugfix:  Cleanup CBC null padding during decrypt

CBC pads incomplete blocks with null bytes, this cleans those off
during decryption.