Now that CHECK_PLNAME is a sysconf option, it can be possible to authorize wizard mode even if get_unix_pw() fails to return the user's login name, so I think the call to check_user_string() should go out either way in case that's what's happening.