Detect also NegTokenArg packet. 

It doesn't have the same GSSAPI header in same way as NegTokenInit has, which caused that packet was passed to application instead of being processed by Waffle. Packet is now detected by it's id (0xa1) and additional
check is done by comparing encoded packet length to actual message array size.

Tested with Windows 7 and Windows 2012 server.