don't set neg mechs on NULL cred
return mechanism mech OID to caller, not SPNEGO's idea of it