so the problem with this idea is that the user has no way of differentiating valid authMechanism ('gssapi') vs a total bs one ('sasl', for example) for future reference for instance.

I'll move the gssapi test below the mongodb-cr one, but I feel very strongly about including the "unknown authMechanism" and gsssapi specific error message versions a catch them all.