working version has security disabled added handshake handler prior to the request but determineUser is null