Add option to search for DN instead of generating it from the username.

This is useful in setups where the username is not part of the DN.
Allow restricting the bind record to a given objectClass.

This allows for additional security and avoids trying to bind to records who happen to have the login attribute.
Make the attribute to look up group membership customizable.
Allow restricting the group records to a given objectClass.

This provides additional security, making sure that no non-group records are treated as groups.
Rename 'required groups' to 'allowed groups' to better reflect the mechanics of the check.