Don't call string_to_sid after cli_lsa_lookup_names() fails.

Don't call string_to_sid after cli_lsa_lookup_names() fails.

Can't use space as a ACL separator as it breaks NT user/group names that
contain spaces (i.e most of the default ones).

The MSDN is contradictory over the exact ordering of ACE entries in an ACL.
However NT4 gives a "The information may have been modified by a computer
running Windows NT 5.0" if denied ACEs do not appear before allowed ACEs.
Sort ACE list before calling cli_set_secdesc().
(This used to be commit 01a89978ff4b9fcc813c4f251ddfe23c0485a696)