improve kerberos client API. start passing auth_type up the chain.