LocalMachine: Fix "require group membership" knob

Require membership in *one* of the specified groups, instead of denying
access if the user is not a member of *all* specified groups.