Enforcing Profile Ordering Policy

Hi,

We are working on the Tunnel profile, with the intention of only allowing
connections after authentication.  What's the standard way for enforcing
a policy on the ordering of profile usage.  I want something along the lines
of the following pseudo-code:

#####################

do some server setup stuff like reading command-line args and such
while(get the next connection)
	advertise only rrsasl profile
	if(rrsasl.authenticated)
		advertise tunnel profile or idxp profile
	else
		advertise profiles that don't need authentication

#####################

We currently only have the ability to do this:

####################

initialize all profile that will be available
start listening for connections allowing any or all profiles to function

####################

Any ideas would be appreciated.

-Nick  (Harvey Mudd College Tunnel Team)