Not an issue with your PR, but I just noticed that the group provider always removes member sids, whereas the user provider only removes groups if `membership == :inclusive`