Called on connection_init BEFORE the ack. Returning false closes the socket with 4403: Forbidden. May write to conn.data to establish identity for the default resolver context.