pam_wheel - only permit root access to members of group wheel