Understand what AAD api should look like

[paulmillr]

a. current, aad in constructor:

chacha20poly1305(key, nonce).encrypt(plaintext)
chacha20poly1305(key, nonce).encrypt(plaintext, dst)
chacha20poly1305(key, nonce, aad).encrypt(plaintext)
chacha20poly1305(key, nonce, aad).encrypt(plaintext, dst)

if we move aad out of constructor, we have two options:

b. aad as second argument

chacha20poly1305(key, nonce).encrypt(plaintext)
chacha20poly1305(key, nonce).encrypt(plaintext, undefined, dst)
chacha20poly1305(key, nonce).encrypt(plaintext, aad)
chacha20poly1305(key, nonce).encrypt(plaintext, aad, dst)

c. aad as third argument

chacha20poly1305(key, nonce).encrypt(plaintext)
chacha20poly1305(key, nonce).encrypt(plaintext, dst)
chacha20poly1305(key, nonce).encrypt(plaintext, undefined, aad)
chacha20poly1305(key, nonce).encrypt(plaintext, dst, aad)

The question is whether to keep a, or to switch to b / c