Should multiple cn entries in a dn be accepted?