fix ldap auth for ishmael/graphite, require wmf group membership

Change-Id: I9ff3f1b6ed8315a508efe0a2baa98571211214b0
Merge "fix ldap auth for ishmael/graphite, require wmf group membership" into production