2.3?
- Figure out how mappings should work with
  krb5_aname_to_localname
  krb5_kuserok
- Check if krb5_cc_gen_new() is really a better way to go when generating
  session credential caches.
- See where the kernel keyring / ccache stuff is and what needs to be done
  to set that up.