Merge changes from topic "face-enumerate"

* changes:
  Finish authentication client when rejected
  Actually use HardwareAuthToken to resetLockout where applicable
  Add enumerate functionality for FaceService