Must set the length of the received token

Otherwise the acceptor tries to do spnego and we are in for
a world of pain.  (The initiator just treats it as a bogus token.)
zero out token length when freeing

We deallocate the storage for the token that was locally allocated
by receive_token(); be careful and zero the length as well.
Back to strong flags

Require two calls to init_sec_context.