fail when someone's left the on/off flags when moving to LDAP{Users,Groups}
don't emit the bind DN password in debug output on successful bind (Bug #3885)