move some code around
decrypts + verifies application data now: conserve stream cipher with its state; also run hmac correctly