removed _group from the end of an apo field and corrected a place where object pid rather than apo pid was being passed to roles