Assume we'll get more TGS reqs than AS reqs
Check internal lengths in password change requests

When checking if a request is a password change, check the lengths that
we should find in the request's own header, and use them to check for
the presence of a KRB-PRIV message appended to the AP-REQ.
Break out server location specifically

Move server location into a callback so that we can do smarter things
than just assuming that the KDC and kpasswd service are local, but that
we can still use the fallback in the simplest cases.
Learn to find servers using krb5.conf and DNS

Use ctypes to load libkrb5.so.3 and ask it where the KDCs are, and if
DNS lookups are allowed (we default to True if there's no explicit
configuration).  If there are no configured servers, and DNS lookups are
allowed, search DNS for a realm's servers.  Try all addresses we get
back until we succeed in connecting to one.