[krbdev.mit.edu #7996] Simplify and improve ksu cred verification

[Greg Hudson via RT]

I marked this for pull-up to 1.13 because it seems like a behavior 
improvement and a reasonably conservative change this early in the branch 
cycle.  But I wouldn't really recommend pulling it up to 1.12 or 1.11, as 
it only helps in marginal circumstances.  (The originally described bug 
in pull request 170 only applies to 1.10.)