Allow for clients that do not request mutual authentication

If a client does not request mutual authentication we're unable to extract a
token to send back to the client and ctx.kerberos_token is None. Before this
fix, when we generate the WWW-Authenticate header in the resulting response, we
cause an exception as we attempt to call join on a sequence that involves a
string and None instead of two strings.