Optimized presence filter rewrite

* If a user’s bind can see members of all the groups in the directory
tree, an isMemberOf presence filter element is not rewritten (i.e. it
stays (isMemberOf=*))
* if a user’s bind has bypass-acl privilege, the plug-in is bypassed
altogether