Sane header behavior for multiple browsers

Sending a token in a 401 causes Chrome to choke
Sending multiple NEGOTIATE headers causes Firefox to loop indefinitely
trying to authenticate.
Added a new ctx entry to track the output token.  This allows the header
to be set only once.  Future improvement would be to stop passing
both the token and the ctx.