Remove ipaNTHash from global allow ACI
    
    ipaNTHash contains security sensitive information, it should be hidden just
    like other password attributes. As a part of preparation for ticket #2511,
    the ACI allowing global access is also updated to hide DNS zones.
    
    https://fedorahosted.org/freeipa/ticket/2856