AES-CTR is indeed what's currently being used. SJCL is definitely an option and we will compare the two to see if there are any large advantages to switching over, thank you for your suggestion.

The reason to why the content isn't being authenticated is due to memory issues in the browser, but we're close to adding a solution for that as well.

Overall the encryption feature is currently in BETA and there will be large amount of improvements before it's finalized.