Move gcm decryption tag check higher up in the callstack