Bug: use KRB5_TCT_MATCH_TIMES only for cc lookup