Various cleanups.
Note that the Group Mappings don't work with preauth because the
fullname instead of the userId is passed to
LdapGroupsProvider.doGetGroups(..)