throw new PACDecodingException("Malformed kerberos token");

            ASN1TaggedObject mechToken = ASN1Util.as(ASN1TaggedObject.class, stream.readObject());
            if ( mechToken == null || mechToken.getTagClass() != BERTags.APPLICATION ||
                    !(mechToken.getBaseObject() instanceof ASN1Sequence) )
                throw new PACDecodingException("Malformed kerberos token");

                this.apOptions = bitString.getBytes()[ 0 ];
                break;
            case 3:
                ASN1TaggedObject derTicket = ASN1Util.as(ASN1TaggedObject.class, tagged);
                if ( derTicket.getTagClass() != BERTags.APPLICATION )
                    throw new PACDecodingException("Malformed Kerberos Ticket");
                try {

        try ( ASN1InputStream is = new ASN1InputStream(token) ) {
            ASN1TaggedObject constructed = (ASN1TaggedObject) is.readObject();
            if ( constructed == null || constructed.getTagClass() != BERTags.APPLICATION ||
                    !(constructed.getBaseObject() instanceof  ASN1Sequence) )
                throw new IOException("Malformed SPNEGO token " + constructed);

        ASN1TaggedObject derToken;
        try {
            derToken = ASN1Util.as(ASN1TaggedObject.class, stream);
            if ( derToken.getTagClass() != BERTags.APPLICATION )
                throw new PACDecodingException("Malformed kerberos ticket");
            stream.close();
        }
        catch ( IOException e ) {