How to force defaulting to heimdal port - a surprise from postgresql96 using base

[Dewayne Geraghty]

Just noticed that the postgresql96-server options
HEIMDAL_KRB5 MIT_KRB5
were removed, 11 days ago.  (They were inherited options defined in
postgresql92)

How do I tell /usr/ports/Mk/Uses/gssapi.mk that only the heimdal port
should be used, in the general sense - for all ports.

Ideally what I would like to do is to tell those ports that I want
kerberos to be used, to only use heimdal port; and preferably with the
bootstrap option to correctly set the build,run dependencies. Something
like:
GSSAPI_HEIMDAL_USES=    gssapi:heimdal,bootstrap or
USES=    gssapi:heimdal,bootstrap
and in some cases
GSSAPI_HEIMDAL_USES=    gssapi:heimdal,bootstrap,flags
depending on how the Makefile is used.

In the absence of a DEFAULT_VERSIONS+=gssapi=heimdal|mit|base (ie
DEFAULT_VERSIONS+=ssl=openssl equivalence).  Would the creation of
/usr/ports/*/*/Makefile.local
that only contains
USES+=    gssapi:heimdal,bootstrap
GSSAPI_HEIMDAL_USES=    gssapi:heimdal,bootstrap
be the best solution, for all the ports I need to use kerberos?

But two questions arise:
1. How does the ports system process variables in USES?
2. If its a "first found" in the list, is there a way to prepend what is
required to the USES variable?

I would appreciate advise/help as to how I can reliably use the heimdal
port. 
Dewayne