auth/spnego: don't produce an output token for errors in gensec_spnego_server_response()