note the code below.  client code either provides a validated email as typed in by a user (`opts.email`), OR it provides a full dn (`opts.dn`).  The former is used to authenticate users, the latter is used by our ldap ping / health check.