Fb hadoop 9200 trunk gd

@haghard 

See rev.comments in https://issues.apache.org/jira/browse/HADOOP-9200, 
in particular:
----------------
In the current code, netgroupToUsersMap is not cleared, so a user's loss of membership to a group or removal of a user will not take effect. So above change seems necessary. But since refresh() is not atomic, requests made during rebuilding of the data structures may incorrectly result in an access violation. We could make cacheGroupsRefresh() and calls to NetgroupCache.getNetgroups() synchronized to solve this problem, but it will be better if refresh happens in background and the new mapping is swapped in as a last step of refresh, so that getGroups() calls are not blocked while refresh is going on.
----------------