design for the next round of changes in… well, design

(the current code ended up having to recursively call itself;
the NSS functions somehow need to be able to get to the token
from having o̲n̲l̲y̲ the numeric uid whereas PAM only has the
username)