s4-auth: quiet down the krb5 warnings when kerberos is not set to 'MUST'