-itself, and character '?' - with the "tokenid". This latter is just an
-arbitrary string that is not involved in the authentication process.
-But, if the template contains '?' but not '~', login process can start
-without the knowlege of the userid. Userid will be picked from the file
-and injected into the PAM environment, given that tokenid is known from
-the start.