added support to return a list of group memberships

I can reduce the duplication but this would also mean it will affect existing logic which i wanted to avoid in case I missed a special case. If you're happy with it I can just drive authenticate() through the group fetch and return false if no group is found?