Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
Subject: updated CFX spec: no unknown token ids; extensions after KRB-CRED
X-RT-Original-Encoding: iso-8859-1
Content-Length: 351

Looks like the CFX spec is changing.  The unknown token id support
(including the returned CONTINUE_NEEDED status and KRB-ERROR token) is
likely to be going away, and in its place, the so-called "checksum" in
the AP-REQ will have an extension field after the Flags or Delegation
fields, which a plain CFX (i.e., not newer than CFX) server must ignore.