NOTE: The test runs and succeeds, but the client seems to be getting a new x-realm TGT after we set the kvno to 0 or remove the kvno from the tickets. This means we're not really testing the TGS paths! So this test is not yet ready.
