Adding support for restricting users to specific groups

This adds support for restricting users to specific LDAP groups, however:

- My LDAP knowledge is poor, is this generic enough, or likely to be specific to our LDAP setup?
- This changes the use of the securityPrincipal field in the configuration and will require any clients to change.