Thanks, that at least provided a useful idea for a workaround.
The initial question is still open, though, any further hints are still welcome!
BTW, for those who are interested here's a bit of background:
in some settings (like mine) it would be awkward to have the password enabled all the time - it's only necessary when carrying the laptop outside.
So, naturally I keep forgetting enabling the password BEFORE leaving. Thus, I wrote a script that detects whether I'm home and if not, it activates the password and sends the laptop to sleep. Next time somebody wakes it up the password is required. Not waterproof, but better than nothing...
Since this scheme no longer works with Sierra, the script forces a log-out instead of just sleep mode.