May want to modify get_cred_via_tkt interface to implement this; if so,
ticket 1429 might be able to take advantage of the revised API too.