Crowd-authentication is still not correctly respecting the list of "authorized users"

FE-2273 implemented a check where the list of "all users" in the Crowd application was filtered by the authorized-groups returned by Crowd.

The problem is, the Directories associated with an Application in Crowd can be marked "allow all users", and we don't check for that.

We need a better way to ask Crowd for the list of all users visible by this Application.