This has brought about some debugging in the decrypt VFP as well.

configure has a flag --enable-set-salt. When enabled, the salt for
an encryption can be set from a bereq header (base64 encoded),
rather than generating random salt. This makes it possible to test
encryption results against known values.