EOSUSER is still using the per-machine Kerberos principal (until next restart), SWAN dropped them (now back)