allow groups to be disabled but kept in ldap: addresses RT #977