Why Policy Server does wildcard searches like userAccountControl=* ?