fixes #7066 - add back $login interpolation for LDAP service account usernames

In cases where an LDAP connection is required outside of the context of user
authentication (e.g. validation of external user group name), an error is
thrown.  Users are recommended to use dedicated service accounts for this
new feature.

---

Wiki page for the new ERF code: http://projects.theforeman.org/projects/foreman/wiki/ERF42-9972.  I'll put something similar in the 1.6 release notes and manual.

The change to the authenticate? call that Leah mentioned in comment 3 of the bug report has been fixed with the UID lookup bit in https://github.com/Katello/ldap_fluff/pull/32 ([el6 scratchbuild](http://koji.katello.org/koji/taskinfo?taskID=143824)).
Correct about valid_group? etc, the line I'm taking is that for these new features you need a dedicated service account (http://theforeman.org/manuals/1.6/index.html#Deprecationwarnings) but existing users who are using auth only won't be impacted.