only run 'update-pam' when needed