s3: improve WHATSNEW around kerberos changes