Ldap group authz

The first commit here is from #70, but is required for these tests to pass.