Fix GSSAPI support and switch to GSSAPI Python module
This fixes GSSAPI support:
- prefer GSSAPI for servers that announce it (allowing proper SSO), before falling back to password-based authentication
- change the "kerberos" Python package (somewhat incorrectly named, since Kerberos is just one of the supported GSSAPI mechanisms) to the "gssapi" module that's used by a number of other projects already and is more Pythonic
- catch and handle GSS errors appropriately