gsskrb5: just don't force, but allow the flags when GSS_CF_NO_CI_FLAGS is given