Only the enrollee can (currently) set up their authenticators. This requires

email confirmation to be enabled so that enrollee_token gets set. (Trying to

allow petitioner_token as well becomes complicated.)

Note however that we also need to allow this step to run if no authenticators

are defined, in order to skip it if email confirmation is not in use (CO-1834).

This sort of crazy logic could probably be removed when CO-1663 is addressed.

$p['establishAuthenticators'] = $isEnrollee || ($steps['establishAuthenticators']['enabled'] == RequiredEnum::NotPermitted);