s4:kdc: split s4u2self and s4u2proxy checks