code: func (c *CookieOverseer) encode(plaintext string) (string, error) {
  	nonce := make([]byte, c.gcmBlockMode.NonceSize())
  	if _, err := rand.Read(nonce); err != nil {
  		return "", errors.Wrap(err, "failed to encode session cookie value")
  	}
  
  	// Append ciphertext to the end of nonce so we have the nonce for decrypt
  	ciphertext := c.gcmBlockMode.Seal(nonce, nonce, []byte(plaintext), nil)
  	return base64.StdEncoding.EncodeToString(ciphertext), nil
  }
docs: // encode into base64'd aes-gcm