s3-kerberos: only use krb5 headers where required.