The LDAP stuff is currently coupled to Oxford anyway (see e.g. https://github.com/ox-it/django-webauth/commit/01e999fb9076db7a3a72c6355a8a3b90c4a80ef2#L6R17), so there's a bit further to go than just this. I think we end up with three settings for LDAP (endpoint, tree to search, and query), none of which have sane defaults.

As we're the only place with a CUD, should we split that bit out entirely?