make pam module run AFTER http access module

This allows us to use 'deny' directives generated by fail2ban to prevent
dictionary attacks against pam authentication.  Note that putting the
module BEFORE $HTTP_MODULES results in it running after, since modules
are run in LIFO order.