cleaned version of tweaks for deep merge of users and groups allow/deny