always log ldap_auth failures
attempt ldap auth even if password empty, so that it blocks users from
trying to authenticate with duo if they provided no password