Description of problem:
When a user has a 2FA authentication-only configured and an initial password
set, he can authenticate to IdM Web UI self-service page and generate a token
for himself. However, until the token is generated (or in case it is deleted by
admin), the user can keep authenticating with just the password, without 2FA.
The behavior could be hardened to avoid this security gap:
* Reject TGS requests for services other than the token management UI/CLI
* [Optional] Issue a short-lived TGT
* [Optional] Disable the user account after a period of time if no token is
created
This step(s) would essentially place new OTP users in a sandbox where the only
thing they can do is change their passwords and create tokens.