Probably better to use krb5_verify_user_opt to detect heimdal