Proposed GSS-API extension requesting to delegate credentials only
according to KDC policy, i.e., OK-AS-DELEGATE set.  Patch from Apple
attached.