Failed SASL auth snotes

Uses +S snomask, only sent if the client is refused due to need_sasl flag being set in auth block.