Also, some writers must not log to the ulog, namely: kdb5_util load
(there's no way for it to know if it's a master or not, so assume it's
a master) and kpropd (since it doesn't now, though it does update the
header, of course).  Also, as long as krb5kdc only modifies
non-replicated attributes we might as well not ulog from it either.