Fix a nil check issue with empty groups

We're hitting an issue where some groups have a `nil` `memberof`. I don't really know why our AD tree is like that, but it causes the `split` in `cn_groups` to blow up. Here's a simple nil check