Are there any security rules applied, with no access given on Var1, or XPath constraints set, before turning security off?
Seems like the access right block the access. So my guess is that turning security off, doesn't turn it off completely. Just thinking...