Use bind_as() to localize LDAP identity changes.

Mangling settings globally means that functions running in parallel will
be affected. Instead, use the newly-added bind_as() method to locally
change LDAP identity.
Replace get_ldap_connection with LDAPUser
Remove get_ldap_connection completely
Merge pull request #64 from tampakrap/sec_pass_v5

Secondary password
Merge pull request #61 from mgorny/openid-auto-logout

OpenID auto logout
Fix handling timedeltas in use_nonce().
OpenID: make nonce creation atomic.

get_or_create() is pointless, non-atomic thing. Instead, just try to
create the nonce and catch IntegrityError.
Add tests for *OpenIDStore.use_nonce().
Add uniqueness contraints to enforce one *OTP device per user.
Make otp_init() race condition safe.

A race condition in get_or_create() may have resulted in two devices
created per user. Now we guarantee only one. Not that it matters real
much...
Make SSL cert auth user creation race condition-free.
Merge pull request #62 from mgorny/get-or-create

Replace get_or_create() with IntegrityError checks
Reuse @require_POST decorator from django.
Add @strong_auth_required decorator.

And support re-login with @strong_auth_required.