Provision groups

Hi, 
this implements most of the group management stuff in the provisioning API.
no tests, because the existing tests flat out refuse to work and i've not had chance to look into why.