Added test and fix to prevent accidentally double encryption.

Encrypted values may get passed around if they're copied as nested objects. Rather than forcing the user to decrypt them before copying (like the case of password migration), it makes more sense to never encrypt  an already-encrypted value.