based upon a patch submitted by Jason Townsend (Apple).

PP_accountLocked error for locked accounts. (Gives too much information
to attackers.)

use "expand" instead of "regex" for group ACLs that allow substring expansion, preserving backwards compatibility; add sanity checks