use noinst_HEADERS for krb5-private.h