gic_pwd.c line 358 acquires the kadmin/changepw credential, using a 
separate gic_options structure from the caller-specified options.

I'm not sure yet what the right solution is.  It might be as simple as 
using the caller-specified options (on the theory that getting a ticket 
with a longer lifetime than we need or flags we don't need isn't really a 
big deal), or it might be more complicated.