Add temporary fix for credential accumulation in heimdal krb5

This isn't really a leak as the credentials will be removed as they expire,
but the standard operation of the krb5 verification functions isn't helpful
here.

The proper fix is to make it optional, and add credential caching code
to MIT too.