lib/hdb/db3.c:DB_open() needs to DB_close() more

Without this the KDC can trip the assert in DB_open().
Use KRB5_TC_MATCH_TIMES when looking for creds
Make fcc_remove_cred() better

Don't use a memory ccache go between, just copy all but the matching
credential(s).
Make Refuses to open symlinks msg less spurious

If we're racing enough we could complain about symlinks where there were
none.  This was very surprising.  Make it surprise less.

We should really #ifndef O_NOFOLLOW that code chunk too, for the obvious
reason that we don't need to worry about symlinks if we have and use
O_NOFOLLOW.

Also, since all uses of fcc_open() use O_NOFOLLOW we should move that
into fcc_open().  Ditto O_BINARY and O_CLOEXEC.
Fix racy file ccache corruption in cred_delete()

We *really* need a ccache instance ID tag.  In fact, we should probably
never krb5_cc_initialize() a ccache that doesn't have such a tag.  But
for now cred_delete() is now safe enough.
Only gate the st_uid fcache checks
Minor refactoring in fcache of common open flags
Test improved fcc_remove_cred()
Use krb5_timeofday() in kuser/copy_cred_cache.c
Add options to kcpytkt and kdeltkt for exp tix
Make kinit cmd not exit on transient errors
Allow batch mode in kinit with password file
kinit should save cc configs if it krb5_cc_move()s

Also, renew_validate() should krb5_cc_new_unique() and krb5_cc_move() it
into place.
kinit cmd: back-off more slowly and warn

Also refactor AFS klog code so we do it only once on renew.
Add SIGINFO support for kinit cmd

Use SIGUSR1 if there's no SIGINFO, so the code isn't dead.
Don't use "if (!ret)"
Add [manual] test of kinit cmd

It's not ready to always be run.  First, it's slow.  Second, it tortures
the system.  Third, it doesn't look for signs of failure.  Fourth, if it
did it'd fail: because something about the racing is causing the KDC to
think that the foo principal doesn't exist.
Fix warning in ! NO_AFS case