log pam authentication errors at ERR level, not debug