FIXME: hadoop method signatures are restricting the SASL
callbacks to only returning InvalidToken, but some services
need to throw other exceptions (ex. NN + StandyException),
so for now we'll tunnel the real exceptions via an
InvalidToken's cause which normally is not set