When TLS is enabled, always use SASL mechanism "PLAIN"

When the connection is protected by TLS, there's no advantage to using a mechanism other than PLAIN. Also, PLAIN is the only mechanism that works for LDAP users, so we want to use it whenever it's secure.