are always called, regardless of whether or not we are going to verify a password. This is needed for proper PAM session support.