Suggested by Zbyszek on IRC. [zj: /run/nologin is used with PAM. systemd-user-session is independent of logind.]