Tweak to reduce risk of misreading

One could misread the old text to imply that the normative requirements
on KDC behavior apply only in cases where S4U are not in use, which
disregards the possibility of other protocol extensions using similar
workflows.

The policy here is due to the (lack of) flow of authorization data
and the corresponding lack of security impact; try to make that more clear.
Add "updates 4120" to Abstract
Remove unused references

Also reference RFC 3961 in the text.