Password changes through pam are not supported, so remove
rules which are commented out or not tested.
If we want this we should actually do some work for this
(passwords should be changed through Puavo web-interface).
Sync comments on pam-account rules (no functional change).
Add pam_cap.so to all auth-stacks (and pam_gnome_keyring.so as
well, where it was missing).  This follows Ubuntu default.
Add pam_systemd.so and "pam_ck_connector.so nox11" to all
session pam-stacks.  These are Ubuntu defaults and at least
one of these (probably both) are needed for desktop to work
correctly (for example without doing this Pulseaudio has no access
to audio hardware).