s4-acl: use dnsforest not dnsdomain for GC names