use RFC2253 DN form
move ticket lifetime policy to mech_browserid