This sounds pretty complicated to evaluate. It also sounds like we need to
cache a copy of the currently bound user's entry with the connection, as I
suggested before for atattr support. I'll look into committing that change
soon. It also seems to me, that the suggestion of caching already-evaluated
ACLs makes sense to do here. The list of evaluated ACLs probably should go
on the connection handle itself, but I was first thinking of adding it to
the cached user entry. Sticking them directly on the connection might be
easier, otherwise we have to implement that virtual entry concept to take
advantage of this trick for bind DNs that don't have corresponding entries
in the slapd database.