s4:kdc: make sure we expand group memberships of the local domain