lib/PublicInbox/IMAP.pm        | 19 ++++++++++++++-----
 lib/PublicInbox/IMAPdeflate.pm |  2 --

diff --git a/lib/PublicInbox/IMAP.pm b/lib/PublicInbox/IMAP.pm
index 13f415cf8d64766a30075befebb36f5e5a7f5f64..803ce31ff2284adb576bff65faf438c8fcb9f1a8 100644
--- a/lib/PublicInbox/IMAP.pm
+++ b/lib/PublicInbox/IMAP.pm
@@ -16,7 +16,7 @@
 package PublicInbox::IMAP;
 use strict;
 use base qw(PublicInbox::DS);
-use fields qw(imapd logged_in ibx long_cb -login_tag
+use fields qw(imapd ibx long_cb -login_tag
 	uid_min -idle_tag -idle_max);
 use PublicInbox::Eml;
 use PublicInbox::EmlContentFoo qw(parse_content_disposition);
@@ -27,6 +27,7 @@ use Text::ParseWords qw(parse_line);
 use Errno qw(EAGAIN);
 use Time::Local qw(timegm);
 use POSIX qw(strftime);
+use Hash::Util qw(unlock_hash); # dependency of fields for perl 5.10+, anyways
 
 my $Address;
 for my $mod (qw(Email::Address::XS Mail::Address)) {
@@ -91,7 +92,8 @@ }
 
 sub new ($$$) {
 	my ($class, $sock, $imapd) = @_;
-	my $self = fields::new($class);
+	my $self = fields::new('PublicInbox::IMAP_preauth');
+	unlock_hash(%$self);
 	my $ev = EPOLLIN;
 	my $wbuf;
 	if ($sock->can('accept_SSL') && !$sock->accept_SSL) {
@@ -110,13 +112,15 @@ 	$self->update_idle_time;
 	$self;
 }
 
+sub logged_in { 1 }
+
 sub capa ($) {
 	my ($self) = @_;
 
 	# dovecot advertises IDLE pre-login; perhaps because some clients
 	# depend on it, so we'll do the same
 	my $capa = 'CAPABILITY IMAP4rev1 IDLE';
-	if ($self->{logged_in}) {
+	if ($self->logged_in) {
 		$capa .= ' COMPRESS=DEFLATE';
 	} else {
 		if (!($self->{sock} // $self)->can('accept_SSL') &&
@@ -129,7 +133,7 @@ }
 
 sub login_success ($$) {
 	my ($self, $tag) = @_;
-	$self->{logged_in} = 1;
+	bless $self, 'PublicInbox::IMAP';
 	my $capa = capa($self);
 	"$tag OK [$capa] Logged in\r\n";
 }
@@ -154,7 +158,7 @@ }
 
 sub cmd_logout ($$) {
 	my ($self, $tag) = @_;
-	delete @$self{qw(logged_in -idle_tag)};
+	delete $self->{-idle_tag};
 	$self->write(\"* BYE logging out\r\n$tag OK Logout done\r\n");
 	$self->shutdn; # PublicInbox::DS::shutdn
 	undef;
@@ -1237,5 +1241,10 @@ # we're read-only, so SELECT and EXAMINE do the same thing
 no warnings 'once';
 *cmd_select = \&cmd_examine;
 *cmd_fetch = \&cmd_uid_fetch;
+
+package PublicInbox::IMAP_preauth;
+our @ISA = qw(PublicInbox::IMAP);
+
+sub logged_in { 0 }
 
 1;
diff --git a/lib/PublicInbox/IMAPdeflate.pm b/lib/PublicInbox/IMAPdeflate.pm
index 42daa6cffaaa37f75b581e4665ebfece65cf8a77..b98a069d9b6d00feb8e7f1aeb520c6d36e34ea45 100644
--- a/lib/PublicInbox/IMAPdeflate.pm
+++ b/lib/PublicInbox/IMAPdeflate.pm
@@ -9,7 +9,6 @@ use warnings;
 use 5.010_001;
 use base qw(PublicInbox::IMAP);
 use Compress::Raw::Zlib;
-use Hash::Util qw(unlock_hash); # dependency of fields for perl 5.10+, anyways
 
 my %IN_OPT = (
 	-Bufsize => 1024,
@@ -41,7 +40,6 @@ 		$self->err("Inflate->new failed: $err");
 		$self->write(\"$tag BAD failed to activate compression\r\n");
 		return;
 	}
-	unlock_hash(%$self);
 	$self->write(\"$tag OK DEFLATE active\r\n");
 	bless $self, $class;
 	$self->{zin} = $in;