Client side Kerberos with Portal Access List object

Try that same code in the HTTP_REQUEST_RELEASE event with a standard VS and http profile:

when HTTP_REQUEST_RELEASE {   
    if {[HTTP::header exists Authorization]}{        
        HTTP::header remove Authorization   
    }   
}

The idea here is to remove the Kerberos Authorization header at the last possible moment before traffic is released to the server, with the assumption that this header is causing problems at the application.