Set preferred tenant

Hi,

as discussed internally, I've implemented an additional argument to explicitly select the OS tenant if required. This is mutually exclusive with VOMS based authentication. At the same time, I fixed a minor bug in the checking of VOMS+X.509.

Björn