make sure IV is part of the HMAC, we don't want a partial decryption oracle in our midst.
make sure IV is part of the HMAC, we don't want a partial decryption oracle in our midst.

teamookla/node-jwt-sessions,mozilla/node-client-sessions