Separate ldap authentication into find_by_principlename and password checking

This is the stuff we were looking at today.

Seems it would be good to pull it out, and may be useful in the ldap code that looks up users by ldap principal names

/cc @gmcculloug