- don't set forwardable and assorted other flags when getting password-
      changing service ticket (noted, and fix supplied, by Onime Clement)
    - use krb5_aname_to_localname to convert the principal to a login name
      and set PAM_USER to the result when authenticating