The code used to work pretty much by accident pre-1.9 because we used to
search for wildcard "*$@REALM" first before any specific search.
We need to fix the search because currently anyone upgrading from the
previous release would have to change their config to include
ldap_sasl_authid.