fs: allow "user:group:" (last colon, empty mode) in -u