Use bind_as() to localize LDAP identity changes.

Mangling settings globally means that functions running in parallel will
be affected. Instead, use the newly-added bind_as() method to locally
change LDAP identity.
Replace get_ldap_connection with LDAPUser
Remove get_ldap_connection completely
Merge pull request #64 from tampakrap/sec_pass_v5

Secondary password
Merge pull request #61 from mgorny/openid-auto-logout

OpenID auto logout
Fix handling timedeltas in use_nonce().
OpenID: make nonce creation atomic.

get_or_create() is pointless, non-atomic thing. Instead, just try to
create the nonce and catch IntegrityError.
Add tests for *OpenIDStore.use_nonce().
Add uniqueness contraints to enforce one *OTP device per user.
Make otp_init() race condition safe.

A race condition in get_or_create() may have resulted in two devices
created per user. Now we guarantee only one. Not that it matters real
much...
Make SSL cert auth user creation race condition-free.