produce whole dn in SQL queries so we don't have to mungle it in code