s3-kerberos: return a full PAC in kerberos_return_pac().