I assume that the password argument to krb5_get_init_creds_password is
never going to be changed by the library (at least, I would hope so),
but it's not declared const, which requires casts for warning-free code
when the caller has obtained it from a const source (such as pam_get_item).