Easiest thing to test first is to make sure you are running the test binding from here:
The default OH2 zwave binding doesn’t include security at the moment.