Token authentication does not work correctly with PAM users

The PAM authentication of users requires a password to verify that the user is who they claim to be. For the normal authentication this is OK as the password is available but for token authentication this is not known. The account type should be stored in the token to remove the need to check it again when the token is validated.