Enable last token deletion when password auth type is configured
    
    Also, ensure that the last token check only executes on DNs/entries that
    are tokens. This resolves a large performance issue where a query was
    being performed to load all the user's tokens on every del/mod operation.
    
    https://fedorahosted.org/freeipa/ticket/4697
    https://fedorahosted.org/freeipa/ticket/4719
    
    Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>