- Fixed pam patch from Steve Grubb (bug #154946, bug #159219):
  - su does not set the pam tty variable. This is needed 
    for auditing among other things.
  - if there is a problem with init groups, session close must be called 
    since session open can mount drives.
  - pam credentials should not be set in the child since the parent will
    need to dispose of credentials later.
  - if there is a fork error, pam credentials need to be deleted and the
    session closed.
  - the parent needs to delete the pam credentials before it ends pam.