code: func (c *CookieOverseer) decode(ciphertext string) (string, error) {
  	ct, err := base64.StdEncoding.DecodeString(ciphertext)
  	if err != nil {
  		return "", nil
  	}
  
  	if len(ct) <= c.gcmBlockMode.NonceSize() {
  		return "", errors.New("failed to decode session cookie value")
  	}
  
  	// Nonce comes from the first n bytes (n = NonceSize)
  	plaintext, err := c.gcmBlockMode.Open(nil,
  		ct[:c.gcmBlockMode.NonceSize()],
  		ct[c.gcmBlockMode.NonceSize():],
  		nil)
  
  	if err != nil {
  		return "", errors.Wrap(err, "unable to open gcm block mode")
  	}
  
  	return string(plaintext), nil
  }
docs: // decode base64'd aes-gcm