static void removeAuthCookie(CookieStore cookieStore, URI uri) {
    HttpCookie authCookie = getAuthCookie(cookieStore, uri);
    if (authCookie != null) {
      cookieStore.remove(uri, authCookie);
    }
  }
This method always needs to be called within a doAs block so that the client's TGT credentials
can be read from the Subject.

@return Kerberos Challenge String.

@throws AuthenticationException on authentication errors.
druid-handler/src/java/org/apache/hadoop/hive/druid/security/DruidKerberosUtil.java