'=' must be escaped (and escapable by '\') according to RFC2253 and draft-ietf-ldapbis-dn-XX (ITS#3009; must have slipped thru some changes long time ago...)

use "expand" instead of "regex" for group ACLs that allow substring expansion, preserving backwards compatibility; add sanity checks

Recognise tree delete control - needs backend support