Verify membership when the dn is in the direct list of members for a group.

This saves us from sending a lot of requests for direct members of a group.

/cc @mtodd