users/groups: fixed user management, added permission "caching"