#399002 libpam-krb5: allow TGT verification by non-root processes