- ksu: move session management calls to before we drop privileges, like su
        does (#596887), and don't skip the PAM account check for root or the
        same user (more of #540769)