if HOST_SPN_ALIAS set, accept RP certs with just a hostname
recover reauth if initiator sent host ticket and we don't accept it