User.groups now points to association table (no longer a proxy to the Group object, due to the need to have access to the key/value metadata)