ssh agent forwarding check is only run when required (and can be disabled)