fixes #7066 - add back $login interpolation for LDAP service account usernames

In cases where an LDAP connection is required outside of the context of user
authentication (e.g. validation of external user group name), an error is
thrown.  Users are recommended to use dedicated service accounts for this
new feature.

---

Wiki page for the new ERF code: http://projects.theforeman.org/projects/foreman/wiki/ERF42-9972.  I'll put something similar in the 1.6 release notes and manual.

The change to the authenticate? call that Leah mentioned in comment 3 of the bug report has been fixed with the UID lookup bit in https://github.com/Katello/ldap_fluff/pull/32 ([el6 scratchbuild](http://koji.katello.org/koji/taskinfo?taskID=143824)).
Should this always create a new LdapFluff object? the `else` clause reuses the existing one, if present.