Quick fix for Kerberos: don't use hardcoded userPlusRealm length

Hey Gustavo,

Looks like I made a silly mistake in my SSPI code, forgot to take out the hardcoded username length.
You're right about msg getting leaked, but I think it's simpler to just `free()` it when you're done with it. That way the current structure works as intended.