Handle additional uncaught GSSErrors

kerberos.authGSSClientStep() can raise a GSSError on a mutual authentication
failure instead of just setting the returncode to -1 as would be expected from
the underlying C library calls. Catch that GSSError and return False so that we
handle the mutual authentication failure appropriately.

Also, since every other kerberos call can raise a GSSError, prophylactically
wrap kerberos.authGSSClientResponse() in such a way as to prevent other
GSSErrors from reaching the user. In this case we'll return the 401 to the user
just as we do when authentication fails in other ways.