Simo asked us to look at this again.  I don't see krb5_copy_error in 
Heimdal, and krb5_get_init_creds_opt_get_error appears to be deprecated 
and non-functional.  Instead, you're supposed to use the krb5_init_creds 
interface and krb5_init_creds_get_error, which we already have.  So I'm 
not sure we need to do anything.