s4-librpc: use cli_credentials_failed_kerberos_login to cope with stale tickets