DTLS window check needs to happen after decrypt

[djwatson]

I think this was broken when decrypt moved in 29f3817.

Decrypt should definitely happen on recv or send if possible to avoid copying user data if crypto framework can be updated to safely copy to/from userspace.