Extensible Pre-Authentication in Kerberos