I was tired and forgot to add they should first check if the IMAP server supports XOAUTH2, and in that case require that to be used. Still not a great solution

I was tired and forgot to add they should first check if the IMAP server supports XOAUTH2, and in that case require that to be used. Still not a great solution but at least not passing the password around.