use krb5_auth_con_setlocalsubkey on Heimdal