AbstractProtocolDecoder will eventually disappear once we move to each server having its own dedicated decoder to make the most of each protocol. With this in mind, and having mentioned in another PR already, I'm not keen on making changes to AbstractProtocolDecoder when you're implementing something that only makes sense for Hot Rod.

I wonder if this could be more simply implemented by providing a new AbstractProtocolDecoder implementation called HotRodSecuredDecoder, which provides the right decode implementation delegates to HotRodDecoder for anything else. This would be much cleaner IMO than using a secure boolean param...