pkinit updates

[Jim Rees]

The environment variable will go away.  We're not done yet.

Of course you could have multiple tokens, or even a single token appearing
on multiple slots.  In that case you must specify which slot you want.  But
if you have only one slot with a token, you don't have to specify the slot
id.  That's because the code now uses the first slot that has a token, if
you don't specify.

I thought about allowing you to specify a token label, and I may do that if
I have time.