There can be multiple ways to provide credentials to an HTTP/SPNEGO connection:

1. cached
2. aquire new with username/password
3. an existing delegated credential from another GSSContext

We haven't supported 3 above.

Note that SASL can fill in the credential into a prop named SASL.CREDENTIALS.