see also notes at http://mailman.mit.edu/pipermail/krbdev/2007-May/005927.html