This addresses issues from #4036
- we use a backward compatible cipher that can implement HMAC signature
- with HMAC signature we can detected mangled data or wrong secret key
- this allows more explicit errors than UnicodeDecode errors
- added a new .ini values that controls strict mode