s3:ntlm_auth: don't start gensec backend twice