Fix server rejecting client fallback after timeout
Fix server rejecting client fallback after timeout

Summary:
If the latency between the client and the server is big, there might
be a case when the server accepts the client's identity and sends a reply, but
by the time this reply arrives at the client, it has already fallen back to
insecure. In this case, the client sends a thrift_auth=0 header and the rest of
the message in plaintext and the server (if policy is set to permitted) is
prepared to handle a plaintext message on a secure channel (by falling back to
insecure) if this is the first message on the connection after security
handshake.

The server has a flag saying whether this is the first message after a security
handshake and if yes, allows fallback and resets the flag to false.

The bug this diff fixes was that the flag was reset to false on the first
_chunk_ of the first message, and not on the first complete message.

So if the client's first message fit in one read() from the kernel, the bug was
masked. However, for bigger messages, the server showed in the log:

```
E1021 13:12:41.119259 545 ProtectionHandler.cpp:94] Exception in
ProtectionHandler::read(): apache::thrift::TKerberosException: Error unwrapping
message Invalid token was supplied; Token header is malformed or corrupt
```

and closed the connection (with either a FIN or a RST depending on whether the
client pipelined the next message or waited for a reply).

Test Plan:
Reproduce the error by forcing the client to fallback even after
receiving a successful handshake response from the server and have it send a
5000-byte message.

(bacause tao build failing, but not related)

Reviewed By: haijunz@fb.com

Subscribers: alandau, yfeldblum

FB internal diff: D2567582

Tasks: 8658995

Signature: t1:2567582:1445468683:b65e8549c6ae5a7c6de190a78693110436f835a0

Orvid/fbthrift,getyourguide/fbthrift,SergeyMakarenko/fbthrift,facebook/fbthrift,LinusU/fbthrift,sinjar666/fbthrift,LinusU/fbthrift,Orvid/fbthrift,facebook/fbthrift,sinjar666/fbthrift,SergeyMakarenko/fbthrift,LinusU/fbthrift,Orvid/fbthrift,Orvid/fbthrift,getyourguide/fbthrift,Orvid/fbthrift,facebook/fbthrift,facebook/fbthrift,getyourguide/fbthrift,getyourguide/fbthrift,sinjar666/fbthrift,getyourguide/fbthrift,facebook/fbthrift,getyourguide/fbthrift,sinjar666/fbthrift,sinjar666/fbthrift,Orvid/fbthrift,SergeyMakarenko/fbthrift,getyourguide/fbthrift,LinusU/fbthrift,LinusU/fbthrift,sinjar666/fbthrift,SergeyMakarenko/fbthrift,SergeyMakarenko/fbthrift,SergeyMakarenko/fbthrift,Orvid/fbthrift,Orvid/fbthrift,SergeyMakarenko/fbthrift,Orvid/fbthrift,Orvid/fbthrift,LinusU/fbthrift,sinjar666/fbthrift,facebook/fbthrift,facebook/fbthrift,getyourguide/fbthrift,sinjar666/fbthrift,getyourguide/fbthrift,getyourguide/fbthrift,Orvid/fbthrift,SergeyMakarenko/fbthrift,facebook/fbthrift,LinusU/fbthrift,getyourguide/fbthrift,facebook/fbthrift,SergeyMakarenko/fbthrift,LinusU/fbthrift,LinusU/fbthrift,SergeyMakarenko/fbthrift,SergeyMakarenko/fbthrift,sinjar666/fbthrift,getyourguide/fbthrift,sinjar666/fbthrift,SergeyMakarenko/fbthrift,sinjar666/fbthrift,LinusU/fbthrift,LinusU/fbthrift