code: func NewClientContextWithFlags(cred *sspi.Credentials, targetName string, flags uint32) (cc *ClientContext, outputToken []byte, err error) {
  	var tname *uint16
  	if len(targetName) > 0 {
  		p, err2 := syscall.UTF16FromString(targetName)
  		if err2 != nil {
  			return nil, nil, err2
  		}
  		if len(p) > 0 {
  			tname = &p[0]
  		}
  	}
  	otoken := make([]byte, PackageInfo.MaxToken)
  	c := sspi.NewClientContext(cred, flags)
  
  	authCompleted, n, err2 := updateContext(c, otoken, nil, tname)
  	if err2 != nil {
  		return nil, nil, err2
  	}
  	if authCompleted {
  		c.Release()
  		return nil, nil, errors.New("negotiate authentication should not be completed yet")
  	}
  	if n == 0 {
  		c.Release()
  		return nil, nil, errors.New("negotiate token should not be empty")
  	}
  	otoken = otoken[:n]
  	return &ClientContext{sctxt: c, targetName: tname}, otoken, nil
  }
docs: // NewClientContextWithFlags creates a new client context. It uses client
  // credentials cred generated by AcquireCurrentUserCredentials or
  // AcquireUserCredentials and SPN to start a client Negotiate
  // negotiation sequence. targetName is the service principal name
  // (SPN) or the security context of the destination server.
  // The flags parameter is used to indicate requests for the context
  // (for example sspi.ISC_REQ_CONFIDENTIALITY|sspi.ISC_REQ_REPLAY_DETECT)
  // NewClientContextWithFlags returns a new token to be sent to the server.