make _krb5_pk_set_user_id update ->cert too