Small authorization and compatibility checking bugs in Sentry conversion tool

When testing the tool from SENTRY-480 on a kerberos cluster I ran into a couple of small bugs:

1) The client is created after the UGI is returned, so may be out of date
2) The compat checker always throws an exception; this exception will list zero errors, but it would cleaner if it only threw exceptions on errors.