finetuning: use class SessionAuthUser instead of AuthUser as superclass
of LdapUsernamePasswordAuthUser