The ex_security_groups kwarg needs to be a list of OpenStackSecurityGroup objects, not just strings