fixed bug where user is in two groups one with and one without policy