Use AES-CBC + HMAC-SHA256

[paragonie-scott]

Closes #1

[paragonie-scott]

To be more precise: This closes one of the two issues mentioned in #1. However, the RNG bias was already reported in an HN comment and the author already said they were going to fix it, so I'm saving myself the trouble of needlessly duplicating effort.

[jes]

var mac = CryptoJS.HmacSHA256(data, key);

I think this should be computing a HMAC of unauthed, not data. But I tried changing it and that still didn't work, I've not investigated what was wrong.

[paragonie-scott]

It looks like a cryptojs bug? I'm following their API as it's documented. Maybe I screwed something up though.