QFS kerberos lib: extract and return client's principal as string, allow to specify principle conversion/extraction flags. Move client's side session key extraction to from reply to request, to allow to bootstrap TLS-PSK earlier and send TLS client hello along with kerberos AP_REQ. Though TLS doesn't really need the key until client key exchange, that comes after server reply. Change invalid invocations error codes to EINVAL, to not confuse them with the kerberos error codes. Update unit tests accordingly.