AD role sync behavior change: first sync is two-way, any subsequent sync uses RM as the authority. Fixes #119.