Require exact credential match; this way even if we su to the original user
that created the session, we won't match his credentials.

(christos)