s4:auth/ntlm: move auth_check_password_wrapper() further down