Allow admins to disable preauth for SPNs.
    
    Some legacy softare is not able to properly cope with preauthentication,
    allow the admins to disable the requirement to use preauthentication for
    all Service Principal Names if they so desire. IPA Users are excluded,
    for users, which use password of lessere entrpy, preauthentication is
    always required by default.
    
    This setting does NOT override explicit policies set on service principals
    or in the global policy, it only affects the default.
    
    Signed-off-by: Simo Sorce <simo@redhat.com>
    
    Ticket: https://fedorahosted.org/freeipa/ticket/3860
    Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>