Defer initial packet payload decryption until after accept

[Ralith]

Reduces the amount of work done for connection attempts that will be refused or ignored when the application layer can do so cheaply, e.g. using a blocked IP list.