s4:lsa move code to add trusted domain user into its own function