s4-gensec Don't give more to sasl_encode() than it will permit