move encrypt/decrypt functions to crypto module
move symmetric decryption of docs to be db-based too