krb5: Fix kinit harder

The previous fixes for using `krb5_cc_default_for()` weren't quite
correct.

lib/krb5/acache.c

@@ -538,7 +538,17 @@ acc_resolve(krb5_context context, krb5_ccache *id, const char *res, const char *
     a = ACACHE(*id);
 
     if (sub) {
-        if (asprintf(&s, "%s:%s", res, sub) == -1 || s == NULL ||
+        /*
+         * For API there's no such thing as a collection name, there's only the
+         * default collection.  Though we could perhaps put a CCAPI shared
+         * object path in the collection name.
+         *
+         * So we'll treat (res && !sub) and (!res && sub) as the same cases.
+         *
+         * See also the KCM ccache type, where we have similar considerations.
+         */
+        if (asprintf(&s, "%s%s%s", res && *res ? res : "",
+                     res && *res ? ":" : "", sub) == -1 || s == NULL ||
             (a->cache_subsidiary = strdup(sub)) == NULL) {
 	    acc_close(context, *id);
             free(s);