Is there a particular reason why gss_accept_sec_context returns GSS_S_FAILURE/ KRB5_RC_REPLAY for duplicate initiator tokens instead of GSS_S_DUPLICATE_TOKEN?