one immediately upon forking to handle a new connection, and one after
the authentication cycle is finished.  Per today's pggeneral discussion.