- make krb_authoritative really work as it's supposed to