changed PlainMechanism to return false when the credential isn't using PLAIN.