Add ability to get ldap user from settings.DIRECTORY or another one

An example could be a temporarily one, or self.ldapobject.directory
Anon user can not have is_verified attr, enable it only for real users
various minor fixes in login tests
Add support for secondary password

Using OkupyCipher I generate a new random secondary password and I add it to
the session. This feature improves user experience and prevents user
from submitting password all time.
Tests for secondary password
Handle unknown hashes in secondary-pass code gracefully.
Add tests for not removing unknown hashes in secondary password