ipsec: fix l2 header handling in ah encrypt