As of 9-ea+148, you can no longer .setAccessible on private/protected methods if the class isn't in a package that has been opened to the application's module. The workaround is to use the --add-opens option:
java --add-opens java.base/java.net=ALL-UNNAMED ...
See #AwkwardStrongEncapsulation for more details.