krb5_get_cred_from_kdc_opt() can return stale creds. See patch for fix.