Child classes of SaslAuthenticationSession are required to set _done to true when authentication is successful, or if if they encounter an error. We could move this state management to the base class, and remove the possibility we forget to set the field. We could also potentially centralize some reporting logic there as well.