We can't just default to useing the krb5_cc_default_for() ccache for a principal -- that breaks a number of uses of kinit.