SMTP servers requiring security/authentication

The SMTP AUTH draft (draft-myers-smtp-auth-05.txt), while providing a
mechanism for a submitting client to authenticate to the server and
establish a secure session, doesn't contain a provision for the server
to inform the client that authentication or security are _required_ for
submission.  I'd like to see an addition to the draft which addresses
how an SMTP server responds to SMTP commands when authentication or
security are required but the client has not successfully issued an
appropriate AUTH command.

The current STARTTLS command (draft-hoffman-smtp-ssl-03.txt) has a
provision along these lines, specifying a response of "505 Must issue a
STARTTLS command first" to any command other than STARTTLS or QUIT if
the server requires TLS.  This might best be generalized to "505 Secure
SMTP session required" and used in both the SMTP AUTH and STARTTLS
worlds.  Similarly, a server which required the client to authenticate
could respond with "506 Authentication required" to anything but a
command which could establish authentication.

Clearly there are some ordering problems to be worked out here - if
someone wants to do a STARTTLS to establish security (but not client
identity) and an AUTH command to authenticate, we don't want the
STARTTLS rejected because of lack of authentication.