Fixups for 9.2

See commit log for details on changes.
Clients do not process received application data until the handshake has been completed, even with False Start, so the "Note that" sentence is unnecessary. An HTTP-level INADEQUATE_SECURITY is actually more secure than a TLS-level alert that cancels the handshake w.r.t. downgrade prevention.