anchor.diff:  	 ;; write the checksum 
   	 (write-sequence cksum s))))))
     
  -(defmethod glass:verify-mic ((context kerberos-context) message message-token &key initiator)
  +(defmethod glass:verify-mic ((context kerberos-context) message message-token &key)
     (let* ((req (kerberos-context-req context))
   	 (tok (unpack-initial-context-token message-token))
   	 (session-key (ap-req-session-key req))
   	 (key (subseq (encryption-key-value session-key) 0 8))
  -	 (message (concatenate '(vector (unsigned-byte 8)) message)))
  +	 (message (concatenate '(vector (unsigned-byte 8)) message))
  +	 (initiator (typep context 'kerberos-client-context)))
       ;; start by getting the checksum and seqno fields
       (let ((seqno (subseq tok 8 16))
   	  (cksum (subseq tok 16 24))
  
positive.code: ;; -------------------- for everyone ------------
  ;; everyone calls this, but the semantics are different if you are a server or client 
  
  (defclass kerberos-context ()
    ((creds :initarg :creds :initform nil :accessor kerberos-context-creds)
     (req :initarg :req :initform nil :accessor kerberos-context-req)
     (buffer :initform nil :initarg :buffer :accessor kerberos-context-buffer)
     (key :initform nil :accessor kerberos-context-key)
     (seqno :initform 0 :accessor kerberos-context-seqno)
     (initiator :initform nil :initarg :initiator :accessor kerberos-context-initiator)))
  
  (defmethod glass:acquire-credential ((mech-type (eql :kerberos)) 
  				     &key principal username password realm kdc-address till-time keylist)
    (cond
      ((and kdc-address username password realm)
       ;; client logging into the domain
       (let ((tgt (request-tgt username password realm 
  			      :kdc-address kdc-address
  			      :till-time till-time)))
         (let ((creds (request-credentials tgt principal :till-time till-time)))
  	 (make-instance 'kerberos-context
  			:creds creds
  			:initiator t))))
      ((and (not kdc-address) username password realm)
       ;; application server generatigna keylist
       (make-instance 'kerberos-context
  		    :creds (generate-keylist username password realm)))
      (keylist 
       ;; application server providing keylist
       (make-instance 'kerberos-context 
                      :creds keylist))
      (realm
       ;; try to get a tgt we already have
       (let ((tgt (find-if (lambda (tgt)
  			   (string= (login-token-realm tgt) realm))
  			 *tgt-cache*)))
         (unless tgt (error "No TGT for the specified user, login by providing user credentials."))
         (let ((creds (request-credentials tgt principal :till-time till-time)))
  	 (make-instance 'kerberos-context
  			:creds creds
  			:initiator t))))
      (t (error "must provide a realm"))))
  
  ;; ----------- for the client ---------------
        
  (defmethod glass:initialize-security-context ((context kerberos-context) &key mutual)
    (let* ((req (make-ap-request (kerberos-context-creds context) 
  			       :mutual mutual
  			       :seqno (kerberos-context-seqno context))) ;; FIXME: also need the checksum!
  	 (buffer (pack-initial-context-token req)))
      (setf (kerberos-context-req context) req
  	  (kerberos-context-buffer context) buffer
  	  (kerberos-context-key context)
  	  ;; the session key can be found in the crednetials (which is a kdc-rep)
  	  (enc-kdc-rep-part-key (kdc-rep-enc-part (kerberos-context-creds context))))
  
negative.code:   (let* ((req (kerberos-context-req context))
  	 (session-key (subseq (encryption-key-value (kerberos-context-key context))
  			      0 8))
  	 (initiator (typep context 'kerberos-client-context))
  	 (message (concatenate '(vector (unsigned-byte 8)) message)))
      ;; start by padding the message
      (let* ((len (length message))
  