force subgroups of secret parents to be secret

[not ready]
### secret parent grp:

> ![image](https://f.cloud.github.com/assets/2665886/1660806/f8dcfd38-5bc7-11e3-9ca0-e051455ed36e.png)

---

### public parent grp:

> ![image](https://f.cloud.github.com/assets/2665886/1660813/0bf17fa2-5bc8-11e3-98e5-baa0a2dc606e.png)

---