You'll need to update this to match changes in encode()

* Split IV from CBC(payload || HMAC(payload))
* Decrypt ciphertext using key and IV
* Split HMAC from payload and verify