Is it just me or does it seem a little ridiculous that this has to be handled this way, and that neither the OpenStack API nor Fog complains if you try to create a server with invalid security groups? Weird.