Relationship between realm, mailbox and SASL user

[Jay Levitt]

I'm setting up a simple server for home use.  The server is running on the
cleverly-named machine linux.home.jay.fm, and will be serving mail for
jay.fm.  I am, for starters, using auxprop with sasldb to keep things
simple.  I'm running imapd 2.1.10 and SASL 2.1.9.  I am creating exactly one
mailbox for jay at jay.fm.

There seems to be a built-in contradiction in the way Cyrus understands
users and mailbox names.  saslpasswd2 appends the FQDN of the server, so
that

 saslpasswd2 -c jay

creates a mailbox "jay at linux.home.jay.fm".  If I explicitly supply a domain
name, like

 saslpasswd2 -c jay at jay.fm

the mailbox is created as jay at jay.fm.  So far so good.

But imapd, by default, uses dots as separators.  So I can't just do:

 createmailbox jay at jay.fm

because that ends up looking like mailbox jay at jay with sub-mailbox fm.  And
I can't just:

 createmailbox jay

because I must authenticate as "jay at jay.fm" and not just "jay".

I realize that I could use unixhierarchysep, and I probably will end up
doing so anyway, but I suspect that there is a simpler answer I'm not
seeing.  I've tried setting

 loginrealms: jay.fm

in imapd.conf, but that doesn't do it.  What is the correct way to handle
this?  I presume every installation has to deal with this in some form or
another.