Send bad_record_mac instead of decryption_failed