Make PAM configurable

Previously it has always been disabled.