Please add support for in-directory password policies

[ghost]

Modern LDAP directory servers can implement sophisticated password policies, some of which can return extended error codes when authenticating a user. These error codes address conditions such as administrator lockout, too many failed authentications, password expired, and password reset required. This behavior is described in the draft RFC http://tools.ietf.org/html/draft-behera-ldap-password-policy-09, which has become a de facto standard in the LDAP community. Adding optional support for password policies would be a great help to folks using LDAP services for authentication.