Tighten up logic around ChangeCipherSpec.