pam common-session is now in puppet - move login check until after puppet is setup