Any thoughts on having pam_krb5 or something else run kdestroy when the user logouts from the workstation?