1047. [bug] When a request was refused due to being signed with
a TSIG key derived from an unsigned TKEY negotiation,
the response could have an rcode of SUCCESS rather
than REFUSED. [RT #1886]