aes-gcm: avoid exposing plaintext on tag verification failure

aes-gcm: avoid exposing plaintext on tag verification failure #943