Context

The PLAIN specification says about auth source:

MUST be specified. Defaults to the database name if supplied on the connection string or $external.

However, the Go Driver currently ignores auth source and always passes "$external" (see here). We should follow the spec and actually pass the auth source, allowing users to override it if necessary.

Definition of done

• Pass the provided auth source through when initializing a PLAIN authenticator. If it's empty, default to "$external".

Pitfalls

Some users may currently be passing an incorrect auth source when using the PLAIN auth mechanism, but their auth is working because the incorrect auth source is ignored. If we "fix" the bug, we may inadvertently break that user's auth. As a result, we may need to do this in a minor or major version release.