more access fixes for group enumeration in LDAP; bug 281