heimdal/gssapi: Allow a NULL authenticator