Cas will check if a user is part of any groups and or is pending user.

This change is related to https://github.com/georchestra/georchestra/issues/581.  With this change users can only login if:

* Their username and password is correct
* They are not part of the PENDING groups (PENDING is configurable but default is SV_PENDING_USERS)
* They are part of at least 1 group
According to our default LDAP setup (https://github.com/georchestra/LDAP/blob/master/georchestra.ldif#L106) it should be set to PENDING_USERS