new handShakeDone flag to allow app data during scr
add client side initiated secure r, same specs