Server: Always set security policy to no-tls if no credentials are given
Remove unused variable