lib/gssapi/krb5: make _gssapi_verify_pad() more robust