Previously, setting access_level for LDAP users was not allowed.
The web interface is able to set an 'override' attribute to stop
LDAP sync from changing the access_level. This adds the same
ability to the API.

Also update API documentation and add tests