PAM: Remove authtok from PAM stack with OTP
    
    We remove the password from the PAM stack when OTP is used to make sure
    that other pam modules (pam-gnome-keyring, pam_mount) cannot use it anymore
    and have to request a password on their own.
    
    Resolves:
        https://fedorahosted.org/sssd/ticket/2287
    
    Reviewed-by: Nathaniel McCallum <npmccallum@redhat.com>