8149070: Enforce update ordering

Make sure that ISE is thrown when updateAAD is called after update.

Reviewed-by: mullan