s4:kdc: Use device claims to evaluate client authentication policy