added UserGroups; Members are now scoped

A member can be part of a scope (account) or global (scope.none)
added scoped authentication for local members