fix CRAM-MD5 security issue