E.g. when server is not configured, and client tries PLAIN security,
there is no hint of why this does not work.

Solution: add debugging output for this case. Note that the various
debugging outputs for security failures should probably be sent to
an inproc monitor of some kind.