anchor.diff:    (let* ((req (kerberos-context-req context))
   	 (session-key (kerberos-context-key context))
   	 (key (subseq (encryption-key-value session-key) 0 8))
  -	 (initiator (kerberos-context-initiator context))
  +	 (initiator (typep context 'kerberos-client-context))
   	 (message (concatenate '(vector (unsigned-byte 8)) message)))
       (pack-initial-context-token 
        (flexi-streams:with-output-to-sequence (s)
  
positive.code: 	  
  ;; ---------- for the application server -----------
  
  (defmethod glass:accept-security-context ((context kerberos-context) buffer &key)
    (let ((ap-req (unpack-initial-context-token buffer)))
      (let ((cxt 
             (make-instance 'kerberos-context 
                            :buffer buffer
                            :creds (kerberos-context-creds context)
                            :req (valid-ticket-p (kerberos-context-creds context) ap-req))))
      (setf (kerberos-context-key cxt) 
  
negative.code: ;; -------------------- for everyone ------------
  ;; everyone calls this, but the semantics are different if you are a server or client 
  
  ;; (defclass kerberos-credential ()
  ;;   ())
  
  ;; (defclass kerberos-client-credential (kerberos-credential)
  ;;   ((tgt :initarg :tgt :reader client-credential-tgt)))
  
  ;; (defclass kerberos-server-credential (kerberos-credential)
  ;;   ((keylist :initarg :keylist :reader server-credential-keylist)))
  
  
  
  (defclass kerberos-context ()
    ((creds :initarg :creds :initform nil :accessor kerberos-context-creds)
     (req :initarg :req :initform nil :accessor kerberos-context-req)
     (key :initform nil :accessor kerberos-context-key)
     (seqno :initform 0 :accessor kerberos-context-seqno)))
  
  (defclass kerberos-client-context (kerberos-context)
    ())
  
  (defclass kerberos-server-context (kerberos-context)
    ())
  
  (defmethod print-object ((context kerberos-context) stream)
    (print-unreadable-object (context stream :type t)))
  
  ;; it is assumed a TGT is already available via a previous call to login-user. 
  (defmethod glass:acquire-credential ((mech-type (eql :kerberos)) &key principal realm keylist)
    (cond
      (keylist 
       ;; application server providing keylist
       (make-instance 'kerberos-server-context 
                      :creds keylist))
      (t 
       ;; try to get a tgt we already have
       (let ((tgt (if realm
  		    (find-if (lambda (tgt)
  			       (string= (login-token-realm tgt) realm))
  			     *tgt-cache*)
  		    (first *tgt-cache*))))
         (unless tgt (error 'glass:gss-error :major :no-cred)) ;;(error "No TGT for the specified user, call LOGIN-USER first."))
         (let ((creds (request-credentials tgt principal)))
  	 (make-instance 'kerberos-client-context
  			:creds creds
  			:initiator t))))))
  
  ;; ----------- for the client ---------------
        
  ;; FIXME: need some mechanism to indicate whether more exhanges are required
  (defmethod glass:initialize-security-context ((context kerberos-client-context) &key mutual)
    (let* ((req (make-ap-request (kerberos-context-creds context) 
  			       :mutual mutual
  			       :seqno (kerberos-context-seqno context))) ;; FIXME: also need the special packed checksum!
  	 (buffer (pack-initial-context-token req)))
      (setf (kerberos-context-req context) req
  	  (kerberos-context-key context)
  	  ;; the session key can be found in the crednetials (which is a kdc-rep)
  	  (enc-kdc-rep-part-key (kdc-rep-enc-part (kerberos-context-creds context))))
  