[sork] Incorrect LDAP search in accounts module

[John Dalbec]

The LDAP backend for the accounts module tries to match the IMP login to 
the "sn" (surname) attribute.  This is wrong - what if two people have 
the same last name?  Depending on how the directory is built, you should 
search on "uid" (using the PADL migration scripts, for instance) or 
"cn".  This should probably be configurable somewhere.
John Dalbec