Fix kpasswd with MIT Kerberos
This fixes a regression introduced with 303b7e59
Due to a bug in MIT Kerberos, which also exists in master as of today, we can't enable canonicalization for non-TGS requests. This partly reverts the change till we have a fix. We've added a knownfail test so we get notified once this has been fixed!
This also starts to run more tests against Samba AD with MIT Kerberos.