sun.security.jgss.krb5.SubjectComber
removes expired tickets from a partial copy of the private credential
set of the subject, instead of the intended internal set of the
subject. Note that when fixing this problem, jgss should synchronize on
the set returned by Subject.get*() before iterating through it, and also
destroy the removed credentials.