The server overwrites any explicit security configuration set on the individual protocols, including realm and mechanisms.
If these are set explicitly, they should be respected.
Additionally, it will enable PLAIN/BASIC when an SSL identity is available even if a password realm hasn't been added