Make options not part of the payload ciphertext

Make the options separate to the payload to allow backward
compatibility.