Users can currently make range requests past the end of the actual ciphertext, which results in the *mac* being treated as ciphertext.