Ss3 compatibility

Hi Hamish,
Please find enclosed an pull request containing initial ss3 compatibility fixes, and more flexible group matching code.

Currently developing a SilverStripe intranet solution that is using this in a Windows Active Directory setting, so will continue updating this where required.