add SASL EXTERNAL to specification.md