local auth flag is expected as part of post body

In the authenticate_user endpoint, the local auth flag is expected
as part of the body - but existing logic was expecting it as a query
parameter.

This change addresses that,and also changes the order of operations
so that local auth takes precedence over any ldap checks. This gives us
minimum degree of testability of local auth option in our current pedant
environment.

Finally this change tightens handling of 'local'. Under opscode-account if
"local" was present and non-false it was assumed 'true'.  Now it must
explicitly be 'true' for it to be accepted.