make authentication correctly respect ldap configuration

- ldap login was incorrectly driven based on presence of
  external_id for a user, and only after that was configuraton of
  ldap considered as a factor. Corrected this so that it will
  always use ldap when ldap is enabled, unless 'local' is set in the
  request.
- new query for correct lookup of user record by external auth id
- various minor modifications to ensure compatibility with
  opscode-manage.