This was announced as a breaking change, and would lock me out if not
set.
I wish the transition went a bit slower, by first introducing the
option for each PAM service, and *then* toggling it. Oh well.
My profiles are actually just "special" NixOS modules in that they
orchestrate settings that usually span the NixOS/home-manager boundary,
or otherwise set up configurations from multiple modules at once.
