systemd_pam would ignore all params after the first invalid one.
Instead ignore just this one, and parse the rest. There's just
one now, but as a matter of principle ;)
Also, allow debug as an alias for debug=1, and don't treat
invalid debug= options as fatal.