posix: allow authenticating anywhere under the base_dn (v3)

v2:
- attempt to fix test failures
v3:
- actually fix test failures