Is this stuff really necessary? Do the chef user/group resources not check the user exists before creating? They're supposed to be idempotent, no?