salsa20/ref: zero sensitive data before returning