added optional hmac integrity check to encryptor