Challenge 4: Oracle
-------------------
POST /decrypt with the body set to the hex of (IV || ciphertext).
Length must be a multiple of 16 bytes and at least 2 blocks.
Response tells you only whether PKCS#7 padding was valid.
  200 {"padding": "valid"}
  400 {"padding": "invalid"}
  422 {"error": ...}   (malformed request -- not a padding answer)