identity: Don't add temporary accounts for expired credentials

The identity service creates a "temporary" kerberos account when a user manually does kinit, to handle automatic renewal, etc.

Unfortunately, it also picks up expired cruft that builds up in KCM based credential caches, and creates temporary accounts for that as well.

This commit tries to avoid that.

Closes #32 (closed)