use noinst_HEADERS for kdc-private.h