ntlm_auth and high server CPU