/etc/pam.d/atd contains:

#
# The PAM configuration file for the at daemon
#
#
auth            sufficient      pam_rootok.so
auth            include         common-auth   
account         include         common-account
password        include         common-password
session         include         common-session
session         required        pam_loginuid.so

The last entry (pam_loginuid.so) breaks submitting jobs as a user.  Users
get:

gedwards@fairseas ~ $ at now
PAM authentication failure: Cannot make/remove an entry for the specified session
You do not have permission to use at.

Removing the last entry (so it matches the crond pam.d file) allows it to
work.  I did a quick search and couldn't find much info on what this pam
module does.