allow acceptor to force XRT upon initiator
update mech todo
s/cbt/cb/ for -02 of GSS BrowserID spec
in OutputDebugJson, check JSON != NULL
use binary decoding of nonce as ASK salt