Merge pull request #2095 from reaperhulk/nc-the-hard-part-redux

name constraints - support IP addresses with netmask