If the user can't manage any group, then it returns an empty list,
which gives them access to all portal groups
Add a git ignore
Update history and Standardise markup
as per https://dev.plone.org/ticket/10231