Better error handling for heimdal

Apparently they don't use the comm_err API so all the messages come out as unknown...
Should use krb5_free_error_message to free error message
Don't add 'no' to cflags when libkrb5 is not threadsafe