this function will check users upon re-certification.  It is what will be called when a user has an authenticated session and attempts to login.  This function is where we'll handle session revocation on password change, account disable, or LDAP deletion.  That is not implemented in this pull request, but the code restructuring will make it an isolated minimal change.