As of today, the auth-pam plugin defaults to sync operation, which has known drawbacks ("freeze the whole process"). To enable async/deferred mode, setenv deferred_auth_pam yes must be used.
We should change from opt-in to opt-out, and make the default async. This has been out in the field for a long time and has had time to really shake down any leftover bugs.
Brought up by @R9295 - give credits when changing.