🚀 go-pugleaf

While it's nice to see people adapting Kerberos for their needs, I
must point out two problems with this use of Kerberos:

1) You're not getting any increase in security because you are still
	sending the user's password in the clear.  The only thing
	you're gaining is not having to maintain a password file(s).

2) Just getting an initial ticket is not sufficent to prove your
	identity.  You've violated the basic
	assumption of client/server *each* sharing a secret with the KDC.
	Where there's only one secret the user can spoof the KDC and
	fool the server in question.  Take a look at MIT's ksu.c for a
	way around this (which requires the server to have a secret).