AS-REP roast accounts without preauth

Accounts with Kerberos preauth disabled hand out an offline-crackable blob to any unauthenticated requester.