* Don't install internal header files.
* Don't print debug info when the "debug" parameter is not given.
* Use PBKDF2 to process expected reply for challenge-response mode.
* Fixup memory leaks and leaks of privilege.
* Let return values reflect whether the user wasn't found or other error.