Make ksu tolerate server referrals better

When verifying the user's initial credentials, don't pass a server
principal name to use to krb5_verify_init_creds(), so that it won't fail
if the server sends us a ticket with a different server name in it.

Because we don't know a pre-set server principal name any more, we can't
preemptively obtain and cache creds for it, or check for its presence
instead of a TGT's, so drop krb5_fast_auth().