Kerberos as method name

To date kerberos has been supported by the "external" method
name.  However, the Client plugin architecture needs to refer to the
method name, and we do not want to expose to the client the
difference between kerberos as performed by an external module or
an eventual kerberos-in-eventlet style implementation.

If the "external" plugin is missing, the old code would throw an
exception attempting to process "REMOTE_USER" behavior.  Now, if only
'kerberos' is specified, this is checked and skipped.

Blueprint: kerberos-authentication
SecurityImpact:  Minimal, as Kerberos is already used via external,
                 this  just changes the main way it is named.

Change-Id: If698fc1d0751cded556825b081539da4dd51275e
Merge "Kerberos as method name"