Kerberized Oozie doesn't allow connections from users with a lot of groups

If you try to use the Oozie CLI in a Kerberized environment with a user in a lot of groups (e.g. the groups list is 30+ lines), all commands fails with

Error: AUTHENTICATION : Could not authenticate, Authentication failed, status: 400

We need to increase the maxHttpHeaderSize that Tomcat allows from the default, 8192 (8K), to 65536 (64K).