Nico points out that if the principal access macros were functions,
fixing the security bug we had with walking off the end of the
principal array would have required only replacing the libkrb5 shared
object, not all the applications.  AS such, unless we have compelling
performance reasons we should make these be functions not macros.