s4-auth: Call krb5_get_init_creds_opt_set_canonicalize() in MIT case.