const SEARCH_TIMELIMIT: i32 = 10;
Cap a directory search (in seconds) so a broad filter cannot make one login scan the whole subtree unbounded.