[Dovecot] force PLAIN auth mech?

[Frank Cusack]

I have

auth_default {
 mechanisms = plain
}

yet clients are able to login using cram-md5.  how can i force use of plain?