Adding relationships is no longer part of the generic save flow
anymore so move the add() below the parent::create() to make sure that
we create the user before we try to add a group to it.
Implement IdentityProvider_GroupDefinition - we expect that in Access.
Print exceptions, don't put them into the response body since they don't seem to show up otherwise.
Use type hinting in _set() and save some type-checking code.