The current implementation does not work with mechanism using WANT_CLIENT_FIRST (plain, ntlm). I am not sure if the fix is 100% correct, because the comment in the source says that we always need an additional sasl_step?