Note an LDAP gotcha pointed out by Robert Bannocks.