[krbdev.mit.edu #8659] SPAKE client asks for password before checking for second-factor support
spake_prep_questions() and spake_process() both indicate a need for the
AS key as soon as they receive a challenge from the KDC, before
checking whether the client can satisfy any of the second factor types
offered by the KDC. We should check the second factor offer first.