don't allow kerberos root login if the root instance is missing