s4-drs: validate RODC credentials via the user_sid