Apply permission settings using user groups. #2

This re-adds what was removed in 0d5a550.