some more work on PAM authentication (work in progress)