Fix and slightly simplify handling of .k5users in ksu

This is a combination of a customer report and some things reported by our testers who dug into it.