It would be sweet if one could specify exactly which SASL authentication mechanisms were allowed at connect time.