ipa-pwd-extop: allow password change on all connections with SSF>1
    
    Instead of checking the individual SSFs for SASL, SSL/TLS and LDAPI connection
    the global SSF is checked for password changes and enrollments.
    
    https://fedorahosted.org/freeipa/ticket/1877