Fixups for 9.2

See commit log for details on changes.
OTOH, if the client is the one generating the INADEQUATE_SECURITY and then falling back (which I think no clients should do), then it MUST NOT send the INADEQUATE_SECURITY message until the handshake has completed. That is, don't false start if you detect INADEQUATE_SECURITY.