Count 'AUTH LOGIN' as a bad command if there is no authentication configured

People should not send 'AUTH LOGIN' if EHLO doesn't report that it's
present. However, some people do and they do so repeatedly, presumably
as part of a bad brute force password guesser. We now count these as
'bad commands' and will disconnect a session after a few of them.

I need to think more about bad command/bad action handling in general to
limit how I want to deal with it and what sort of limits there should
be, but this will do for now.