tgs-rep: always return canonical realm when force_canonicalize set