encryption: Implement a slightly improved AesCipher encryption.

This addresses issues from #4036

- we use a backward compatible cipher that can implement HMAC signature
- with HMAC signature we can detected mangled data or wrong secret key
- this allows more explicit errors than UnicodeDecode errors
- added a new .ini values that controls strict mode

configs/development.ini

@@ -119,6 +119,10 @@ rhodecode.api.url = /_admin/api
 ## `beaker.session.secret`
 #rhodecode.encrypted_values.secret =
 
+## decryption strict mode (enabled by default). It controls if decryption raises
+## `SignatureVerificationError` in case of wrong key, or damaged encryption data.
+#rhodecode.encrypted_values.strict = false
+
 full_stack = true
 
 ## Serve static files via RhodeCode, disable to serve them via HTTP server

configs/production.ini

@@ -93,6 +93,10 @@ use = egg:rhodecode-enterprise-ce
 ## `beaker.session.secret`
 #rhodecode.encrypted_values.secret =
 
+## decryption strict mode (enabled by default). It controls if decryption raises
+## `SignatureVerificationError` in case of wrong key, or damaged encryption data.
+#rhodecode.encrypted_values.strict = false
+
 full_stack = true
 
 ## Serve static files via RhodeCode, disable to serve them via HTTP server