Since it is possible to use the smart card to authenticate against the KDC, we have to make sure it is available before calling kinit. We probably shouldn't move kinit to later in the process, so we need to move tl-wait-smartcard to a very early position. Not ideal since it slows down the session startup, but probably necessary. (Related: should tl-sso-update-password also be before kinit?)
