hm -- according to https://github.com/fail2ban/fail2ban/pull/175#issuecomment-16538036  they should be coming from post-authentication routine ... I guess we should check if indeed they could not be triggered otherwise