[pkcs11] Disabling CKU_SO after token has been initialized

["Oscar K So Jr." <oscar.so@oracle.com>]

Anyone interested to disable CKU_SO after the C_InitToken is called (or, 
after token has been initialized) ?

For example, a USB security token for the retail customer do not need 
CKU_SO, and there is only CKU_USER involved after the manufacturing and 
provisioning state. If CKU_USER maxed out the login retry count, the 
token should ask if the user wants to perform C_InitToken instead of 
sending it back to the manufacturer.


--

Best,
Oscar