bugfix: of course I need to add the OCP users to the OCP group, not the FOP group
(although they should already be in there)