Once upon a time //net's use of HTTP 'negotiate' authentication mechanism was controlled via use_kerberos and USE_KERBEROS macros. //net stopped explicitly using Kerberos several years ago and since then the name has been a confusing proxy for HTTP 'negotiate' support. Making matters worse, Windows, (macOS, Linux, ChromeOS), and Android have three different means by which //net attempts to interact with an underlying GSSAPI provider.

As a first pass, we could rename use_kerberos to use_http_negotiate with the correspondingly named USE_HTTP_NEGOTIATE. Then each platform can enable/pick their platform specific implementation conditioned on that.

The platform specific selections could also be centralized in //net so that derived args like use_gssapi, use_sspi, and use_android_cred_manager are used for individual feature selection instead of complicated feature testing spread out all over the codebase.