s3-ntlmssp clarify session key behaviour after create_local_token() changes