make pam support optional. make the default authorizer able to load and save accounts, and generalize its permissions level by introducing groups with configurable permissions. make auth thread safe