Server 12 and secured/SSL client connection status

We are using FMSA 12.05 on OS X 10.8.5.  We have configured the server to require secured connections (i.e. use SSL) for the FMP client.  However, we don't appear to always be getting secured connections when clients log in.

We have an 'open' script that runs when clients log in, finding various information about that user.  I included a step to set a global variable to the connection state when a user logs in, and that is displayed on a layout.  90% of the time when I log in (local account, full access) it shows that I am connected via a secured connection (state=2).  But, the other 10% of the time, it tells me that I am on an unsecured connection (state=1).

This is the calculation (done to make it more human readable when displayed):

Case (
    Get ( ConnectionState ) = 0 ; " 0 - no network connection for the current file " ;
    Get ( ConnectionState ) = 1 ; " 1 - non-secured connection " ;
    Get ( ConnectionState ) = 2 ; " 2 - secured connection using FileMaker Server’s default SSL encryption" ;
    Get ( ConnectionState ) = 3 ; " 3 - secured connection with a fully verified server name in the certificate " ;
    "No information available."
)

How can it be giving non-secured connections, if the server is configured to require secured connections?  It apparently is dropping the user to an unsecured one if it can't establish a secure one, is my guess... but why would it do that instead of throwing an error and informing the user about the problem?  (Yes, we could do that ourselves in our login script I suppose.)

I haven't been able to narrow down or replicate the problem consistently.  If I notice it, and log back in, chances are high that I will get a secured connection the next time around.  Not always though; there have been times when I logged in a few times and still ended up unsecured.  But then co-workers would log in at that same time and get secured connections.  

Any ideas as to what's going on and how the decision tree about secured connections works?

Thanks,

Justin