set pin in token enroll is disabled, if ramdom_pin policy is set

extended the token setup function to support additional options
this option parameter signals if for this user/realm an otp_pin_random
policy is set. the check, if the policy otp_pin_random could be used
is implemented in the system/getPolicy call, which now takes user
and action as additional filter. In all token enrollment dialogs
the set pin has been moved to the end of the input parameter list
+ some small gui changes

Change-Id: Ibd7acc583c5c38216b19ca004cb3bac0c89b9dde