IPSet support

If a destination is a simple CIDR, without port and protocol, then add it into
an ipset specific to the user. This ipset is looked up at the top of the user's
iptables custom chain.
Discard duplicated ACLs

If a destination CIDR is listed multiple times in LDAP, only use the first occurence.
Moar Code Prettyness
/me sucks at english