auth/spnego: only try to verify the mechListMic if signing was negotiated.