In some non-standard implementations, the server may respond AUTH_USER_PASS even if's not listed in available authentication methods. (it should respond AUTH_NO_ACCEPTABLE per standards)