GDM/gnome-shell expects being able to tell apart various failure modes
from the pam_fprintd.so. However, using "sufficient" means that the
generic error code from pam_deny.so will be returned.
Use default=bad, to ensure that the failing error code from
pam_fprintd.so is correctly exposed to GDM.
