It would be more efficient to carry out GSS credentials negotiation as user, as we already switch identity to fetch the credentials cache.