optional LDAP auth

Right now it just pops open the browser login dialog, we can add a nicer login page if we want.

example config:
```
ldap:
  uri: ldaps://myldap.com:636
  cachePolicy: maximumSize=10000, expireAfterWrite=10m
  userFilter: ou=people,dc=yourcompany,dc=com
  groupFilter: ou=groups,dc=yourcompany,dc=com
  userNameAttribute: cn
  groupNameAttribute: cn
  groupMembershipAttribute: memberUid
  restrictToGroups:
      - user
      - admin
      - bots
  connectTimeout: 500ms
  readTimeout: 500ms
```

@wsorenson @gchomatas @Eseb