TheIPsecarchitecturedocumentstatesthatwhentwotransportmodeSAsarebundled to allow both AH and ESP protocols on the same end$-$to$-$end flow, only one ordering of security protocols seems appropriate: performing the ESP protocol before performing the AH protocol. Why is this approach recommended rather than authentication before encryption?