I didn't think to look at the standards for the auth mechanisms, I only looked at the smtp standards.  So, if the standard says utf-8, then we should use that.  But we should still support bytes passwords so that an application could work around issues like the possible ms-exchange one, if they need to.  Those could be two separate PRs, though.  In fact, they probably should be.  As a standards-compliance issue, we would be within our rules to backport the utf-8 standards-compliance fix.