s4:auth/credentials: use krb5_data_free()