Fixups for 9.2

See commit log for details on changes.
That second point is the one I wanted to capture.  In most cases I'm aware of, it's the client who needs to send the INADEQUATE_SECURITY.  It's a pretty screwed up case if the server is generating it.

Well, there's nothing wrong with generating the INADEQUATE_SECURITY, it's the falling back that's the issue here.