[feature] group.canCreate works for root user