Support full functionality when multiple keys are available

[simo5]

In some configurations it is desirable to support using multiple names in a single configuration.
In case a principal alias is not the right solution this means we'll have a keytab with multiple names in it.
For some operations we need to acquire creds explicitly, we should try to do so with the correct "name".

[adelton]

This is based on FreeIPA load balancing setup, described in https://pagure.io/freeipa/issue/6919.

By default, the ProxyPreserveHost directive is off, so the hostname in the subrequest from the front-end load balancer to the real FreeIPA server uses the real FreeIPA server's Host: HTTP request header.

[simo5]

For now ProxyPreserveHost may need to be used, in future we may be able to use a GSSAPI extension to avoid acquiring credentials in advance and let GSSAPI pick the right key instead.

[simo5]

@adelton @frozencemetery what do you think ?

[adelton]

LGTM.

[frozencemetery]

#139 seems like the correct solution to me; left review there.