MCO-473 Handle exceptions in securityprovider.decodemsg

Here we add an unverified version of the senders identity.  It's used in one
codepath, that of handling a failure to decode and get at the true sender of a
message.

We also add variant handling of the exception.  If we can be assumed to be a
client (type == :request) then log and press on, otherwise reraise as the
server codepath copes fine.