Add ability to get ldap user from settings.DIRECTORY or another one

An example could be a temporarily one, or self.ldapobject.directory
Anon user can not have is_verified attr, enable it only for real users
various minor fixes in login tests
Add support for secondary password

Using OkupyCipher I generate a new random secondary password and I add it to
the session. This feature improves user experience and prevents user
from submitting password all time.
Tests for secondary password
Handle unknown hashes in secondary-pass code gracefully.
Add tests for not removing unknown hashes in secondary password
Use bind_as() to localize LDAP identity changes.

Mangling settings globally means that functions running in parallel will
be affected. Instead, use the newly-added bind_as() method to locally
change LDAP identity.
Replace get_ldap_connection with LDAPUser
Remove get_ldap_connection completely
Merge pull request #64 from tampakrap/sec_pass_v5

Secondary password