move key WQL restrictions from WHERE/IN to JOIN

To get "plus" working I had to redo our "any/or" handling, and it helped me understand why any/or has seemed to be pretty flaky.

The basic approach is now to do a LEFT join for the complicated stuff and then put the OR handling in the WHERE clause using only the ids returned by the join