Allow login to WebUI using Kerberos aliases/enterprise principals
    
    The logic of the extraction/validation of principal from the request and
    subsequent authentication was simplified and most of the guesswork will
    be done by KDC during kinit. This also allows principals from trusted
    domains to login via rpcserver.
    
    https://fedorahosted.org/freeipa/ticket/6343
    
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Simo Sorce <ssorce@redhat.com>
    Reviewed-By: David Kupka <dkupka@redhat.com>