Allow a client to enroll using principal when the host has a OTP
    
    If the host has a one-time password but krbPrincipalName wasn't set yet
    then the enrollment would fail because writing the principal is not
    allowed. This creates an ACI that only lets it be written if it is not
    already set.
    
    ticket 1075