Heimdal kdc preauth

While researching a very strange (at first) test failure in Samba when trying to rebase lorikeet-heimdal up to the modern world, I noticed that Heimdal no longer returned KRB5KDC_ERR_PREAUTH_FAILED errors. 

This gave the client library KRB5_GET_IN_TKT_LOOP internally when it got KRB5KDC_ERR_PREAUTH_REQUIRED twice in a row. 

This adds a potential fix, which should be carefully examined by someone who understands the intended behaviour in the presence of multiple possible PA requests on the AS-REQ.