Handle policy change while keyguard disabled

Previously the policy change would always re-enable the keyguard,
but that would break the current state.  Instead, when the keyguard
is disabled, we need to recalculate the allow state immediately
and only re-enable it if necessary.

Bug: 18430385
Change-Id: Id9e701df2db765031e177c8bc8d3730cfb7f162a