Cleanly separate gssapi (negotiate) auth code from (future) gssweb auth code.