User's secret question/answer should be required only if configured so

```
See

https://groups.google.com/forum/?fromgroups=#!topic/superfly-discuss/nRvIPP8HGpc

I think we should tie this to policy setting: for PCI they are required, for 
none policy they aren't.
```

Original issue reported on code.google.com by `roman.puchkovskiy` on 6 Dec 2012 at 8:14
