export KRB5CCNAME to make sure that curl knows where to read the
kerberos credentials.