The counter is not secret, so the code does not need to be
constant time.

benchmark                    old MB/s     new MB/s  speedup
BenchmarkAESGCMSeal1K           89.90        92.84    1.03x
BenchmarkAESGCMOpen1K           89.16        92.30    1.04x

R=agl
CC=golang-dev
https://golang.org/cl/40690046