Require gnutls
Allow unencrypted connections; fix various SASL problems

There was a race condition: if the server responded with a challenge
before the client had moved from :wait-for-greeting to :sasl-auth, the
challenge would be considered unexpected data.  Fixed by issuing the
AUTHENTICATE command in the enter-state function of :sasl-auth,
i.e. already in the correct state.

SASL authentication didn't work for mechanisms that require the client
to send data first, e.g. PLAIN.  Since there is no way to ask the Emacs
SASL library whether that is the case, let's assume so if the server
sends an initial empty challenge.

Also update state-data in a sneaky way to avoid another race condition.