dsdb-acl: ask for the objectClass attribute if it's not in the scope of the clients...