When user provides --token-type or specific --token-id prefer token PIN query over passphrase query (if token handler responds with 'PIN needed'). Fixes: #670.