external_auth: move ldap error handling to ldap_session to fix 500 on CONSTRAINT_VIOLATION
Revert "first try at extra_domains, not sure if this will work"

This reverts commit 1762cb810144d62cb03a8e0cfacd280315909a43.