On some hosts, the default domain isn't stanford.edu.  In those
cases, we need to tell k5start that we only want to get stanford.edu
credentials.