factored out domain components for users and groups
edit user CGi does not die
user class: more compatible management of  common attributes, remove suprefluous stuff in User::ExternalAD
users from external group: get group membership, forbid write operations