update docs to describe AES 256 defaults