Move things around so hpn applies cleanly when using X509.

--- a/Makefile.in
+++ b/Makefile.in
@@ -46,12 +46,13 @@
 CC=@CC@
 LD=@LD@
 CFLAGS=@CFLAGS@
-CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ @LDAP_CPPFLAGS@ $(PATHS) @DEFS@
+CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
 LIBS=@LIBS@
 SSHLIBS=@SSHLIBS@
 SSHDLIBS=@SSHDLIBS@
 LIBEDIT=@LIBEDIT@
 LIBLDAP=@LDAP_LDFLAGS@ @LDAP_LIBS@
+CPPFLAGS+=@LDAP_CPPFLAGS@
 AR=@AR@
 AWK=@AWK@
 RANLIB=@RANLIB@
--- a/servconf.c
+++ b/servconf.c
@@ -153,9 +153,6 @@ initialize_server_options(ServerOptions *options)
 	options->zero_knowledge_password_authentication = -1;
 	options->revoked_keys_file = NULL;
 	options->trusted_user_ca_keys = NULL;
-	options->authorized_principals_file = NULL;
-	options->ip_qos_interactive = -1;
-	options->ip_qos_bulk = -1;
 
 	options->hostbased_algorithms = NULL;
 	options->pubkey_algorithms = NULL;
@@ -168,6 +165,9 @@ initialize_server_options(ServerOptions *options)
 	options->va.certificate_file = NULL;
 	options->va.responder_url = NULL;
 #endif /*def SSH_OCSP_ENABLED*/
+	options->authorized_principals_file = NULL;
+	options->ip_qos_interactive = -1;
+	options->ip_qos_bulk = -1;
 }
 
 void
@@ -367,9 +367,6 @@ typedef enum {
 	sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
 	sUsePrivilegeSeparation, sAllowAgentForwarding,
-	sZeroKnowledgePasswordAuthentication, sHostCertificate,
-	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
-	sKexAlgorithms, sIPQoS,
 	sHostbasedAlgorithms,
 	sPubkeyAlgorithms,
 	sX509KeyAlgorithm,
@@ -380,6 +377,9 @@ typedef enum {
 	sCAldapVersion, sCAldapURL,
 	sVAType, sVACertificateFile,
 	sVAOCSPResponderURL,
+	sZeroKnowledgePasswordAuthentication, sHostCertificate,
+	sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
+	sKexAlgorithms, sIPQoS,
 	sDeprecated, sUnsupported
 } ServerOpCodes;