There *is* a default PAM service name: `riak`. Do we need to call that out here? Otherwise, people might think you always have to specify `service=` as an option for PAM auth.