Check TLS state before requesting SASL EXTERNAL

Make sure a remote server can't circumvent "s2s_use_starttls: required"
by offering SASL EXTERNAL authentication over a non-TLS connection.
Merge pull request #181 from weiss/check-tls-before-auth

Check TLS state before requesting SASL EXTERNAL for outgoing s2s connections