acl: make version check for one-time tokens specific to region

[tgross]

One-time tokens are not replicated between regions, so we don't want to enforce that the version check across all of serf, just members in the same region.

Adds a new helper function that specifically calls out the regional filter.