use browser aes decryption by default
rename prepare_pms() to start_audit()
removing extra communication round by sending cs_cr_sr_hmacms_verifymd5sha