auth/spnego: invert the fallback logic in gensec_spnego_client_negTokenInit()