davidben
Store service tickets in ccache
Actually get a ccache for that matter. If a service requests a ticket multiple times, we shouldn't have to talk to the TGT all the time. (This leaks some information in that you can infer whether someone else has requested that ticket, but it's probably not that interesting. We can also cache per-origin or something, I don't know.)
Ooh, can we allow storing tickets for multiple principals, and have a client-cert-like dialog (with better UI) for picking which one to use? :P
Multiple sign-on would be cool. Though we may need to think about what UI we want in the end and possibly adjust the cross-origin API accordingly. My understanding is that OAuth with Google, for instance, is blind to multiple sign-on. The end result is kinda awkward. You end up requesting which user multiple times and there's no easy way to switch users after you've logged in.