In response to !3 (comment 42842)
The USER environment variable is set after login, and since this package
is not used before login, it is safe to use. This way we don't have to
keep a downstream attempt to turn shadow in a shared library which no
one is going to upstream.