slightly rework user/operational attributes handling (including fixing a bug in the logic of the previous change to backend_operational()); cleanup; more improvements to slapo-rwm and back-relay

Add better approx test

Suggested fix provided by Wout van Albada

should be allowed to the entry at the naming prefix (database suffix).

Referrals need work (not sure why return referrals for bind requests)