Hopefully you have read the caveats for the current releases? The security features are still in development.
Also, please check out this recent thread where I summarised how security is supposed to work and which bits might actually work at the moment.
In there is also an offer to create a new branch of uibuilder so that people can collaborate on the security features.
From your posted image, I can see that you have sent a msg with msg._auth.id set to null which will never work as that is the one piece of information you absolutely must supply since nothing makes any sense without it. That is all documented in the technical docs.
