clean up #user_groups
rename deprecated method parameters so as not to confuse cbeer
don't use ivars for user/session; use accessors.