s4:ldap.py - give the "primaryGroupToken" test a better name