no validation of target name in gss_init_sec_context

[Sam Hartman]

As discussed, an attacker can impersonate a user if the attacker can control the target name in gss_init_sec_context.
It's important that we validate the form of this name.
This validation needs to:

* Be done in browser-independent code (preferably javascript, although there are ways of doing this in c+?+
* be done in a manner that allows us to easily add new name forms in the future
* be done in a manner that allows us to add new validations of other function inputs in the future
* be done in trusted code