Control clients get one PROTOCOLINFO before they must issue an AUTHCHALLENGE or AUTHENTICATE, and the Authenticate() implementation uses PROTOCOLINFO. This allows users to call ProtocolInfo() before Authenticate() without mysterious failures.