(2) Add an additional step in which the client is required to send a MIC of the session ID before authentication can succeed. This is essentially the same as what we do in key exchange, but in the reverse direction.This MIC can be sent as soon as the context is GSS_C_PROT_READY, on whichever side it's PROT_READY first. Though, it may be easiest to fit it into the last message from the client.
No; the direction actually matters. A MIC sent from the server to the client does not serve to bind the session to the client's identity, and thus does not solve the problem we are trying to address.