Steps to reproduce:

1. configure an engine with LDAP
2. execute a TaskQuery taskService.createTaskQuery().taskCandidateUser("foo").list()

Observed Behavior:
The guards for creating the SQL statements are based on the methods TaskQueryImpl#getCandidateGroups().

The method TaskQueryImpl#getCandidateGroups() calls #getGroupsForCandidateUser(). This method queries the identity provider for the candidate user's groups, in case of LDAP. The result is not cached in the query object, so when the Mybatis mapping calls TaskQueryImpl#getCandidateGroups() a second time, it will ask LDAP a second time and so on.

Expected Behavior:
The identity provider is called only once.