Remove the 'user' group, and make 'enabled' its own group

Also polish the HTTP API so that /login and /check are consistent
in their return values.