agent: Call pam_acct_mgmt() when creating user session

This allows PAM to deny access for the user, so we now
respect HBAC.

Fixes #493
Closes #566
Reviewed-by: Marius Vollmer <marius.vollmer@redhat.com>