This uses an extra LDAP bind operation to do authentication. Because
  it does not rely on HTTP basic authentication I had to introduce a
  session (probably resulting in cookies).

and throw an exception if it doesn't. Previously the code just failed.

  - show login errors as alert on the login page

This allows to filter for users even before a bind attempt is done
through the login form. This improves security by allowing to use LDAP
filtering to identify eligible users at a very early stage.