Adjust things around new member of AD-enabled team

[mookid8000]

When a user is added to an AD-enabled team before logging in the first time, then the user's login is prevented in an overly-protective attempt to block overtaking someone else's user.

The following changes should be made:

When a user signs in with AD and the email address matches an existing login without an AD associated, the appropriate auth settings for that email should be looked up to see if they match – if they do, make the login AD-enabled and allow the login.

Also, when the user is added to the team manually, and the team is AD-enabled, don't create a set of credentials for that user – instead, tell the user to sign in via AD.