auth/credentials: make cli_credentials_get_ntlm_response() more robust