skip legacy SASL mechanisms if client wants CB