Add detection for users from trusted/invalid realms
    
    When user from other realm than FreeIPA's tries to use Web UI
    (login via forms-based auth or with valid trusted realm ticket),
    the 401 Unauthorized error with X-Ipa-Rejection-Reason=denied
    is returned.
    
    Also, the support for usernames of the form user@SERVER.REALM
    or user@server.realm was added.
    
    https://fedorahosted.org/freeipa/ticket/3252