Soon:
- Learn to set up tokens for use by rxk5-enabled cells, once a spec for
  what the structure we provide to the cache manager should contain exists.

Later:
- Figure out how mappings should work with
  krb5_aname_to_localname
  krb5_kuserok
- Check if krb5_cc_gen_new() is really a better way to go when generating
  session credential caches.
