While this makes sense (absence of connection in connectionsAwaitingSasl means server conn), how about matching it on type of Connection and throwing an error if client connection is not present in connectionsAwaitingSasl ?
If I understood this right, it should not happen right now - but given how critical this codepath is for auth (incorrect in case we get security messages after we thought auth was done : which means something is wrong) would be better to guard it against future change which break this ?