Restore krbCanonicalName handling
    
    When an entry has a krbCanonicalName, if KRB5_KDB_FLAG_ALIAS_OK is set,
    rewrite the principal name to the canonical value, else error out,
    instead of always returning an error if the requested name doesn't look
    like the canonical one.
    
    https://fedorahosted.org/freeipa/ticket/3966
    
    Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>