Only bitch about missing genPassword in success response.

better implementation for ITS#4996 and docs (ldapsearch(1) only; need to duplicate in other tools man pages)

handle returns in ldappasswd(1) and ldapwhoami(1).  Likely needs to be
added to other ldap*(1) commands.

Purports to remove kbind, but adds a ldap_search_s() request.

allow host resolution via DNS SRV based on the DN portion of the URI if no host is provided (ITS#4996)