Kerberos implementation questions