Pick only the NTLM challenge from the auth cookie