Only try DIGEST-MD5 if there's no SSL/TLS or if PLAIN isn't supported
Which in practice means "don't bother with DIGEST-MD5 most of the time".
It's weak, pointless over TLS, and often breaks with some servers (hi openfire)
