- don't set forwardable and assorted other flags when getting password-
changing service ticket (noted, and fix supplied, by Onime Clement)
- use krb5_aname_to_localname to convert the principal to a login name
and set PAM_USER to the result when authenticating