- in login, allow PAM to interact with the user when they've been strongly
        authenticated
    - in login, signal PAM when we're changing an expired password that it's an
        expired password, so that when cracklib flags a password as being weak
        it's treated as an error even if we're running as root