Drop support for --no-ipsets - it's in mainline for long enough
+nfacct