Add a key rotation story.

[davidben]

zephyr.Session needs some story for what to do when the krb5.Credential attached to it expires. The main difficulty is switching the session key sanely because the zephyr protocol doesn't make this very easy.