Love, do you have code to implement the cross-realm part of this change
in MIT krb5?  (Corresponding to r23846 in Heimdal which strips
ok-as-delegate from cross-realm tickets if the TGT ticket didn't have it.)

If not I will do it myself this week; I just want to make sure I'm not
duplicating effort.