a suggestion for improving pkinit preauth plugin token choosing

[Sam Hartman]

I think slot/token ID is sufficient if you will try a specified
slot/token even if you were not able to examine its certs because login
would be required.