Don't advertise auth mechanisms too early

If "starttls_required: true" is specified for c2s connections,
authentication mechanisms shouldn't be offered before negotiating the
TLS connection.