Fixed two security holes:
- when sending distributed message, use ConnectionSecurityContext instead of SystemSecurityContext
- don't cache Connections when fetching because it bypasses the security check