Read-only default domain for LDAP (bug 1168726)

NOTE: this patch effectively *removes* a feature new in grizzly
(multi-domain support for LDAP) in favor of fixing our existing 99% use
case (proper read-only support for LDAP for a single domain).

A proper fix to the above was also blocked by bug 1117356, so that's
fixed here as well (updates properly return the resulting entities).

Change-Id: I672b90e67545cc1fe65b05ef7f8af5b42ca6afc3