TODO downgrade on LOGON_FAILURE??? gensec: move event-using code to gensec_update...