distinguish between upgrades and fresh installs. Also, mark BROKEN when users try to build WITH_LDAP_SASL but WITHOUT_SASL2.