SAMR query sec obj returns different results depending on which sam handle

SAMR query sec obj returns different results depending on which sam handle
it is passed.  Not sure what these different contexts are called or what
they are used for.

 - if a rid is specified to samquerysecobj then use the sam user policy
    handle for that rid
 - if -d is specified then use the sam domain policy handle
 - otherwise just use the sam connect policy handle

JF, any ideas about this?
(This used to be commit 4ef50ef9f76219ea8acc29a1d740b31a1d7a1e04)