diff --git a/plugins/router_spnego/router_spnego.c b/plugins/router_spnego/router_spnego.c
index 8ae40b71..77bae7d3 100644
--- a/plugins/router_spnego/router_spnego.c
+++ b/plugins/router_spnego/router_spnego.c
@@ -91,6 +91,7 @@ static char *uwsgi_spnego_new_token(struct wsgi_request *wsgi_req, struct uwsgi_
 		goto end;
         }
 
+
         ret = gss_acquire_cred(&min_ret, server_name, GSS_C_INDEFINITE, GSS_C_NO_OID_SET, GSS_C_ACCEPT, &cred, NULL, NULL);
         if (GSS_ERROR(ret)) {
                 uwsgi_spnego_err("gss_acquire_cred", ret, min_ret);
@@ -99,6 +100,7 @@ static char *uwsgi_spnego_new_token(struct wsgi_request *wsgi_req, struct uwsgi_
 
         gss_buffer_desc output = GSS_C_EMPTY_BUFFER;
 
+
         ret = gss_accept_sec_context(&min_ret, &context, cred, &token, GSS_C_NO_CHANNEL_BINDINGS, &client_name, NULL, &output, NULL, NULL, NULL);
 
         if (GSS_ERROR(ret)) {
@@ -157,13 +159,14 @@ end:
                 gss_release_name(&min_ret, &client_name);
         }
 
+	if (cred != GSS_C_NO_CREDENTIAL) {
+		gss_release_cred(&min_ret, &cred);
+	}
+
         if (context != GSS_C_NO_CONTEXT) {
                 gss_delete_sec_context(&min_ret, &context, GSS_C_NO_BUFFER);
         }
 
-	if (cred != GSS_C_NO_CREDENTIAL) {
-		gss_release_cred(&min_ret, &cred);
-	}
 
 	if (ub) {
 		uwsgi_buffer_destroy(ub);