kdc: don't misidentify constrained delegation requests as anonymous