Issued by the TGS, it is used to identify to a service such as
OWA email that a principal is who they say they are. It contains:
- username/ID
- http service name/ID
- network address (list of IP addresses or null)
- timestamp
- lifetime of validity
- HTTP service session key