osx: deal with more kerberos damage