group_show should never return private data

If a sysadmin calls `group_show`, it returns private data of all the users who are members of the group. If a user who's a member of a group calls `group_show`, it returns that user's private data as part of the group dict. This is unexpected and dangerous behavior.