(krb5_get_kdc_cred): make sure that out_creds points to NULL on failure