Don't use camel-case LDAP attributes in ACI and don't clear enrolledBy
    
    We keep LDAP attributes lower-case elsewhere in the API we should do the
    same with all access controls.
    
    There were two ACIs pointing at the manage_host_keytab permission. This
    isn't allowed in general and we have decided separately to not clear out
    enrolledBy when a host is unenrolled so dropping it is the obvious thing
    to do.
    
    ticket 597