explicitly record sasl auth states

It was previously possible to bypass authentication due to implicit
state management.  Now we explicitly consider ourselves
unauthenticated on any new connections and authentication attempts.

bug316

Signed-off-by: Dustin Sallings <dustin@spy.net>