The first thing we should do is to harmonize the `authenticate` events. I think we can easily use `authenticate` for md5, too. The same this applies for XOAuth. Just generate a different user object. As before, the server adds the sasl mechanis and the handler is then able to react properly based on the submitted methods. See https://github.com/node-xmpp/node-xmpp-server/blob/master/test/sasl-test.js#L36.
This would eliminate the emit authenticate event because we do it as before via callback.