Don't advertise authentication mechanisms too early

If `starttls_required: true` is specified for c2s connections, authentication mechanisms shouldn't be offered before negotiating the TLS connection.