Kerberos/GSSAPI auth weirdness?