security: extract domain from username in NTLM