agent: Call pam_acct_mgmt() when creating user session

This allows PAM to deny access for the user, so we now
respect HBAC.

Fixes #493