also updated comments about things it shouldn't be used with
Control clients get one PROTOCOLINFO before they must issue an AUTHCHALLENGE or AUTHENTICATE, and the Authenticate() implementation uses PROTOCOLINFO. This allows users to call ProtocolInfo() before Authenticate() without mysterious failures.