ldapsearch + read-only domain controller: cannot bind