* debian/libpam0g.postinst: change 'cupsys' to 'cups' in the list of default desktop services that are ignored in deciding whether to prompt for service restarts on upgrade. Partially addresses LP #278117. * debian/libpam0g.postinst: also filter out samba, which may be installed on the desktop to enable filesharing. * debian/libpam-cracklib.prerm, debian/libpam-runtime.prerm: add the ubiquitous debhelper tokens (currently a no-op) * pam-auth-update: Use -Initial only for the first profile, even when there's no explicit -Initial config for that first profile * fix common-session/common-password to use the same overall stack structure as auth/account, so that we get the correct behavior when all password modules fail. LP: #272232.