login: log PAM errors to syslog, not stderr