Setting receiver capacity to zero does not always stop the message flow

Calling "setCapacity(0)" on a receiver sends out a MessageStopBody to the broker, which in turns causes the broker to reset the credits to zero. However, there is a potential race condition if any MessageTransferBody completions for the same receiver are later sent to the broker. When the broker receives the completions, it will increase the credit, resulting in additional messages being transferred to the receiver.

Steps to reproduce:
1) Create a receiver and set a non-zero capacity
2) Receive one or more messages from the receiver
3) Set the receiver capacity to zero
4) Release the accepted messages back to the broker
5) Ensure that the session sends a completion (e.g. have another receiver on the session w/ capacity 1 and get a single message)

Actual Results:
The receiver will receive additional messages since its credit was increased on the broker

Expected Results:
The receiver will not receive additional messages