s4:rootdse: only return "tokenGroups", when the client asked for them