heimdal_gssapi: accept SASL with empty authzid