Increase security, reliability, etc

* mkuser uses getent to check if user exists locally before creation
* mkuser uses --gecos --disabled-password for better user creation
* mkuser uses pam_crowd.py to check whether a user should be created locally or not
* mkuser is executed during auth step, where it will actually execute