s3/auth: implement "winbind:ignore domains"