With a twist: in order to be consistent with the crypto_stream interface, the tag has to come before the ciphertext.
Frank Denis