the binkp.js default, 32-hexchars/16-bytes). Even IRex v2.31 requires a
16-byte challenge, so experiment is over.
Log more details when a CRAM-MD5 authentication response doesn't match
(e.g. to make case-mismatch or other cause of authentication failures
potentially more obvious - still debugging the Mystic inbound CRAM-MD5
auth failure and this might help).