Comment 29 for bug 501956

(In reply to comment #23)
> This patch log for "none" method when login attempt is made by a invalid user.
 > But works correctly for existing valid user (doesn't log for "none" method )

That happens earlier than the auth loop (in getpwnamallow). I'm not sure I want
to change that right now as it's the only place guaranteed to be called for an
invalid user if they try only, eg pubkey authentication then disconnect (because
that occurs purely in the unprivileged child).

We may be able to address that with the AUDIT_EVENTS hooks but those aren't
enabled by default.