Allow search() to request user/group attributes

[wlupton]

Also prevent repr() from including the password.

[tinvaan]

I think instead of a static string, we can maybe mask the password string matching it's length?

I know this gives away the length of the password but that could still be useful for users to know which password was used to configure the server.

Suggested change

	return "<CrowdServer('%s', '%s', '********')>" % \
	(self.crowd_url, self.app_name)
	return "<CrowdServer('%s', '%s', '%s')>" % (
	self.crowd_url, self.app_name, '*' * len(self.app_pass))

Optionally, we could add a private method that returns the raw password (probably out of scope for this PR).