Drop sup groups BEFORE changing uid

@basepi, needs cherry-pick