Registrar: fixed login check/reservation

 - fixed case, when user and his logins were new, but considered as already in use and unreserved from KDC

Correct logical order when approving any application is now
 - set all non-login attributes
 - create member / add to group
 - unreserve new login, if user already have login in same namespace
 - set login attributes, which are purely new