AES-CCM: fix tag calculation at decryption