Handling errors more sensibly

If authentication fails, the server response will be passed to the user. This is
likely to be a 401. A 403 would indicate successful authentication with an
unauthorized user.

If the client requires mutual authentication (the default, similar to ssl
certificate validation in requests proper), an exception will be raised so that
the user does not have the opportunity to accept an untrusted response. If
they're okay without requiring mutual authentication, then they can specify that
when constructing their HTTPKerberosAuth object.