Avoids extra user canonicalization calls which often go back to an
external info source, such as the same LDAP directory we just fetched
the info from.

This does mean you can no longer implement configurations where you
import from LDAP and use ExternalAuth to fetch different user info from
another source, but I think that's an acceptable tradeoff.