Fix that roles w/o assigned credentials grant all credentials on Kerberos auth
Log which user sent which command to the new command log