* method #changed? also tracks changes of identites (fixes issue with email mapping)
* find ldap identity before initialize one