Luke Howard notes that SPNEGO's acc_ctx_call_acc() should only call gssint_get_mech_type() for the first token, because not all mechanisms wrap subsequent context-establishment tokens in the generic DER-like token framing.