Make sure to encrypt-then-mac instead of mac-then-encrypt[1]

[1] http://crypto.stackexchange.com/questions/202/should-we-mac-...