Configure a KDC, add test for GSSAPI/Kerberos
    
    Using nss_wrappers so we can control host names we can
    setup a KDC and test GSSAPI, including fallback to
    forms-based auth.
    
    This also means that fetch_page() needs to handle 401
    a bit better, so it can re-try a failed authentication or
    fall back to forms-based auth.
    
    Note for posterity: if gss_localname() fails this is likely
    due to using the wrong krb5.conf in Apache, so pass in all
    environment variables.
    
    The KDC setup code was based heavily on the tests in the
    gssproxy project.
    
    https://fedorahosted.org/ipsilon/ticket/116
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-by: Simo Sorce <simo@redhat.com>