Ensure that $session->{'CurrentUser'} always contains a value

Some logic in RT assumes that the session always contains a CurrentUser,
even if that user is empty.  Replace all instances of delete with a set
to a blank CurrentUser object.

This resolves CVE-2012-2770, wherein a RSS url for a user could be used
to gain access to a fully logged-in session as that user.
Merge branch 'security/rss-cookie'
Update Module::Install
Version bump
Added "group_scope" as a configurable option.

This patch allows the scope of the LDAP group search to be configured,
instead of being hard-coded as "base".

It is useful to change the scope to "sub" when there are nested groups.

The default option has been kept as "base".
Test the new group_scope option

There is one TODOed test because of a Net::LDAP::Server::Test bug.  I
fixed that bug and a related bug uncovered at the same time and issued a
pull request.

https://rt.cpan.org/Ticket/Display.html?id=78612
Catch a missed failed login warning
Merge branch 'configurable-group-scope'
Merge branch 'master' into multiple-emails

Conflicts:
	ChangeLog
	lib/RT/Authen/ExternalAuth.pm
	lib/RT/Authen/ExternalAuth/LDAP.pm
Version update to dev release 0.11_01