More info printed by update_roles.
update_groups now associates ApiUsers.