RFC 3920: Section 6.2.2:

                                                                 If Use

       of TLS (Section 5) needs to be established before a particular

       authentication mechanism may be used, the receiving entity MUST

       NOT provide that mechanism in the list of available SASL

       authentication mechanisms prior to TLS negotiation.  

so in /src/java/org/jivesoftware/wildfire/ClientSession.java: (line ~300)

        sb.append("");

        }

        if (connection.getTlsPolicy() != Connection.TLSPolicy.required) {

            // Include available SASL Mechanisms

            sb.append(SASLAuthentication.getSASLMechanisms(session));

        }

        // Include Stream features

        String specificFeatures = session.getAvailableStreamFeatures();

        if (specificFeatures != null) {

            sb.append(specificFeatures);

        }

        sb.append("</stream:features>");