auth: disable legacy auth by default

Legacy authentication can expose password in plaintext. Since this is
not widely used mechanism, disable it by default. It can be enabled back
with connection option XMPP_CONN_FLAG_LEGACY_AUTH.

src/common.h

@@ -172,6 +172,7 @@ struct _xmpp_conn_t {
     int tls_failed; /* set when tls fails, so we don't try again */
     int sasl_support; /* if true, field is a bitfield of supported 
                          mechanisms */
+    int auth_legacy_enabled;
     int secured; /* set when stream is secured with TLS */
 
     /* if server returns <bind/> or <session/> we must do them */