Fixes for edge cases

See the individual commits for details:

• Don't call pam_sm_open_session within pam_sm_authenticate
• Exit early if the target user is root
• Don't do anything if the password is empty
• Verify that XDG_RUNTIME_DIR is usable