zsh: handle kerberos credentials on login