Record the real-user-id and real-group-id, then set them to root when pam-escalate-helper starts. That makes it look more like ssh/login/etc. and makes modules like pam_krb5.so actually update the user's credential cache.
Call pam_setcred() after a successful pam_authenticate() in pam-escalate-helper.
Moved environment variable to/from GVariant functions to escalate_util.{h,c}.
Fix new memory leaks from last commit.