client/pam: allow root account always