auth/spnego: don't pass 'in' to gensec_spnego_create_negTokenInit()