Fix KCM ccache per-type cursor

While answering a user question about credential caches, I realized that the KCM per-type cursor didn't have the behavior we expect from other collection-enabled cache types.  Here is a fix.  I don't think there's any specific need to test this on OS X since I could test stuff like this just fine against a Heimdal kcm on Linux.  But feel free.