I was trying to make sure my users only use secure passwords when logging into my server.
To do this I found out I need at least these settings in imapd.conf:
# Allow the use of cleartext passwords on the wire? no!
allowplaintext: no
# these make sure that only encrypted sasl methods are in use:
sasl_minimum_layer:128
sasl_mech_list: digest-MD5 CRAM-MD5
allowplainwithouttls:no