CKF_PROTECTED_AUTHENTICATION_PATH
(si->token.flags & CKF_PROTECTED_AUTHENTICATION_PATH) ?
if (si->token.flags & CKF_PROTECTED_AUTHENTICATION_PATH)