LinkedAuthenticationHandlerAndCredentialsToPrincipalResolver checks multiple AuthHandlers

The default behaviour for the linked CrentialToPrincipal resolver is to
stop after the first failed password.  We need to check all possible
authentication Handlers before declaring the credential 'bad'
Make AD the primary source for authentication and attributes