Also do the subgroups/transitive stuff dance when considering if a user is in a group...