Remove check for using CSR values with non-CA certificate.

The endpoint enforces whether the certificate is a CA or not anyways, so
this ends up not actually providing benefit and causing a bug.

Fixes #1250

Update sys-step-down.html.md

Fix a typo

Restore the previous valid token if token authentication  fails

Enfore ACLs for sys-capabilities endpoint

Fix Typo

Don't renew cert-based tokens if the policies have changed.

Add ability to exclude adding the CN to SANs.

Fixes #1220

Add `-field` and `-format` to write command.