don't leak Kerberos context if reauth not supported