move NEWS comment to correct location

NEWS

@@ -6,13 +6,18 @@ unreleased (207x-xx-xx)
     parameter does. Also, fix some whitespace messiness in
     /etc/pam.d/sshd [adamhl]
 
-release/005.010 (2017-10-02)
-
     [syslog] Add use_logsink_server parameter that allows servers to not
     send logs to the logsink server. Once everyone is using Splunk, ELK,
     etc., we will set this default to false. In the meantime, the default
     is true. [adamhl]
 
+    [pam] Add "ensure" parameter to base::pam::debian to allow the
+    non-installation of some Kerberos-related PAM packages in the special
+    case of non-production Kerberos servers not synced with production
+    Kerberos environment. [adamhl]
+
+release/005.010 (2017-10-02)
+
     [kerberos] Use three rather than four "kdc" lines in
     /etc/krb5.conf. [adamhl]
 
@@ -26,11 +31,6 @@ release/005.010 (2017-10-02)
     off-campus Instead, just have everything go through smtp.stanford.edu
     (which still has an on-campus presence). [akkornel]
 
-    [pam] Add "ensure" parameter to base::pam::debian to allow the
-    non-installation of some Kerberos-related PAM packages in the special
-    case of non-production Kerberos servers not synced with production
-    Kerberos environment. [adamhl]
-
 release/005.009 (2017-07-07)
 
     [ntp] Push "tinker-panic 0" to the top of the ntp.conf file to help