correctly construct KRB-CRED for Heimdal reauth