fix(accounts): SSH keys with spaced comments, one token per create, OTP errors

- An SSH public key whose comment holds spaces (ssh-keygen -C "John Doe
  laptop") is accepted; only the type and the key are checked.
- The created API token is shown by a GET after a redirect, so reloading
  the page no longer creates a second token the user never sees.
- The OTP login page shows field errors instead of an empty error box.
- A user without a local password (an LDAP user) is not offered a password
  change that could never succeed.

webvirtcloud/tests/test_authorization_matrix.py

@@ -39,6 +39,7 @@ ALLOWED_FOR_ANY_USER = {
     "accounts:change_password": "the user's own password; new users get the permission by default",
     "accounts:ssh_key_create": "the user's own SSH keys",
     "accounts:api_token_create": "the user's own API tokens",
+    "accounts:api_token_created": "the token the user just created, from their own session",
     "set_language": "UI language switch",
     "console": "renders an error without a valid token; access is checked per VM",
     "ds_openstack_index": "cloud-init datasource, fetched by VMs",