Allow service user and group to differ and only create group if needed.

Fixes #17 and fixes #18.
Also no longer assumes user name = group name.