Stop using authz functions to change user groups

They contain too much incorrect permission checking