exempt some users from OpenLDAP password policy