Restrict placeholders to only valid ones

This uses the tuple of fields from the User object created by the
LDAP connector as the source for the valid fields passed to the
Previewer, ensuring that this will match the true valid set.

Update libfritter to pick up support for this and add a new system
test to prove it.

Change-Id: Id4aa0673b4b1b539b023821922272d12db9c2328
Extract config loading to a helper

Change-Id: I112eb81233d5af5323aa0bf7dbd7f6d2eb591e1f