code: private static byte[] consumeRenewToken(ExtendedGSSContext c,
                                              byte[] wrappedToken)
          throws GSSException {
          if (!GSIConstants.MODE_SSL.equals(c.getOption(GSSConstants.GSS_MODE))) {
              throw new GSSException(GSSException.NO_CONTEXT);
          }
          byte[] framedToken = c.unwrap(wrappedToken, 0,
                                        wrappedToken.length, null);
          byte[] token = new byte[framedToken.length - 4];
          System.arraycopy(framedToken, 4, token, 0, framedToken.length - 4);
          return token;
      }
docs: Unwraps and discards frame of a token according to the GRAM "renew"
  protocol for use in a GSI delegation handshake.  The input token is
  received from a globus job manager and comes wrapped (SSL mode) and
  framed with a 4 byte big-endian token length header.
  
  @param c The context to use to unwrap the token
  @param wrappedToken Token received from job manager during GSI handshake
  @throws GSSException if an error occurs during token wrapping or if
  context is insufficient
  @return a token that can be passed to the context's next initDelegation