minimal ldap auth working with custom token, not yet ready for merging back into master (needs some refactoring)