I ran in to an issue with a user getting a 400 error on an IIS server. Turns out it was related to a large Kerberos token size due to being in too many groups. Here is a little script to enumerate the information you need to determine the token size:

This is all outlined in Microsoft KB327825 and relates to Microsoft KB2020943.