security: improve Kerberos w/o Single Sign-On & SSPI