Fix fallback in validate_tgt()
    
    To validate a TGT a keytab entry from the client realm is preferred but
    if none ca be found the last entry should be used. But the entry was
    freed and zeroed before it could be used.
    
    This should also fix the trusted domain use case mentioned in
    https://fedorahosted.org/sssd/ticket/1396
    although a different approach then suggested in the ticket is used.