tweak limits for variable-length arrays

Change-Id: Ia2253fd64d6d0fe44c575bb961a02ba68aa808df
tweak max authenticator size to match comment

Change-Id: I222ed85d32388a227feb52efc807084447beda70
Reword intro a bit

We do describe many integration details.

Change-Id: Ie68b0c04b8b9646df0e5d7d1523b790e1623ada2
xref rfc3961 for kerberos crypto

Change-Id: Ida8be508b9bb19fe34199f7180c7e0b3af0fb6c9
detabify key usage values

Change-Id: I33db4cb49fe7bd5137872d05f21d401f571d2b2f
wordsmith client usage of token

Change-Id: Ieda8ad43f276bfb03864d39d01cedfd6060031f9
Clarify GSS loop overview and reference service name generation

Change-Id: I2dac599ed44d9ea3b3ee99990dd3dab5e0517841
Be descriptive about StartParams' invariance

Change-Id: I9b46f019e66f76613eae69156194cc110331a71f
condense the three GSS flags needed

Change-Id: Ifadef2bebefcd4021711aed074ff1b939fa78032
Remove unneeded statement

The next GSS call will detect this error; we don't need to do it
ourselves (though we could if we wanted to).

Change-Id: I13ce08a2b806c4f17a56cbed3bc9ae9d8b4817ca
clarify that conf_state is returned by gss_unwrap()

Change-Id: Iec329b113bddb0a71e1b0a33d385bd9c70791461
Reword security considerations for client_nonce

The MIC of the StartParams structure (which contains the client_nonce)
is returned to the client in an encrypted structure, so a
direct man-in-the-middle downgrade attack on the starting parameters
is not possible.  Uniqueness of the structure can still be useful, though.

Change-Id: Ife0d175a49828fcf906b0fbde062331ba10e276e
Roll changelog

Change-Id: I3a0f2125350468c9347e60836a1c901609154d62