Skip CHAUTHTOK_PRELIM when using OTPs
    
    https://fedorahosted.org/sssd/ticket/2484
    
    When OTPs are used, we can only used each authtoken at most once. When
    it comes to Kerberos password changes, this was only working previously
    by accident, because the old authtoken was first used to verify the old
    password is valid and not expired and then also to acquire a chpass
    principal.
    
    This patch looks at the user object in LDAP to check if the user has any
    OTPs enabled. If he does, the CHAUTHTOK_PRELIM step is skipped
    completely so that the OTP can be used to acquire the chpass ticket
    later.
    
    Reviewed-by: Sumit Bose <sbose@redhat.com>