s4:auth/ntlmssp: let _unwrap fallback to seal if sign only doesn't work