future-proof: allow multiple round trip Kerberos exchanges at acceptor