Handle additional uncaught GSSErrors

kerberos.authGSSClientStep() can raise a GSSError on a mutual authentication
failure instead of just setting the returncode to -1 as would be expected from
the underlying C library calls. Catch that GSSError and return False so that we
handle the mutual authentication failure appropriately.

Also, since every other kerberos call can raise a GSSError, prophylactically
wrap kerberos.authGSSClientResponse() in such a way as to prevent other
GSSErrors from reaching the user. In this case we'll return the 401 to the user
just as we do when authentication fails in other ways.
Fixing assertions regarding mocks not being called; resetting mocks

We need to reset mocks between tests if we want to be sure when we assert
whether or not they've been called and what they've been called with because if
we don't, they may have been called during other tests.

We mock.assert_not_called() isn't a thing, but it always returns a Truthy value
because it's a mock, and any method not defined will actually exist and return a
mock which is truthy. My head hurts. We need to assert that the special .called
parameter is False.
Test to ensure that authGSSClientStep during mutual auth raises the right exception.

Prevent regression of the leaking GSSError's we recently saw on mutual auth
failures.
Flipping assertion around, assertFalse(x) instead of assertTrue(not x)
Merge pull request #12 from mkomitee/master

Handle additional GSSErrors