move CB validation into libsasl