fix for crash in Kerberos-only case