Deal with an empty list of groups, and notify the frontend when groups change

Just two little issues I noticed while noodling:

  * Using the "manage user access" function, I could add group memberships to a user, but they didn't take effect until that user logged in again.  Just needed to send a notification to the frontend to get it to refresh its permissions.

  * If I used the same method to remove all of a user's group memberships, it wouldn't stick.  The HTTP client doesn't send through empty parameters, and there was a conditional in the backend controller that caused it to do nothing when the parameter was missing.  I switched it to treat "missing group parameter" as "empty list".  I think that's OK, but would appreciate another pair of eyes.