PAM module (and CLI tool) to validate an OpenAM token