s4-auth Supply more useful error messages on Kerberos failure