dovecot - Oct 2016 - Requiring client certificate on only one interface

Hi,

I'm trying to require client certificates on only one interface. I'm
running dovecot 2.1.7. There have been a couple of recent threads about
this kind of configuration:

http://dovecot.org/list/dovecot/2016-August/105244.html  (Aug 2016)

http://www.dovecot.org/list/dovecot/2016-February/103067.html (Feb 2016)


However, these threads recommend an approach that no longer works. 
Specifically, the "-l" or "-P" arguments to imap-login no
longer work.
Is there currently a recommended way to configure dovecot like this?

Braden