Treat KRB5_GET_IN_TKT_LOOP as invalid password

Treat an KRB5_GET_IN_TKT_LOOP error as an incorrect password.  Heimdal
KDCs sometimes return it, and Heimdal kinit treats it this way.
Use a more random password for the password change test

I got some password reuse forbidden errors from Heimdal with the
previous temporary password construction.  Not sure if it's related,
but may as well make something more random.