is it possible for handleClientAuthNeg to be invoked right after sendSecurityMessage and before adding to connectionsAwaitingSasl ? (pre-emption, repsonse from other side before we get back here).
If yes, we should add to connectionsAwaitingSasl before sendSecurityMessage.
a conn.close will clean up connectionsAwaitingSasl anyway iirc, so it should not introduce any other side effect.

any thoughts ?