[#33293] Apply Authorised Groups changes through the backend to the logged in user in the frontend without re-login

Overcoming the issue that changes to a user's authorised groups are not detected and applied immediately to the related user while it is logged in i created a workaround with the following flow:

1. Changes made to a user object's groups and levels are catched by the onUserBeforeSave handler and dumped in a temporary plugin property.
2. After the changed data was stored, the user object's groups are newly loaded and compared to the previously dumped property. If something changed, the related user's session data is loaded from the database table by a new JSessionHelper, parsed into a human readable format and extended by a new entry indicating that the user's session must be refreshed. This data is then stored back into the session table.
3. If the related user is logged in while this change is made, its session is automatically updated on the next page reload, thus receiving the refresh-flag previously set in step 2. A newly added system plugin evaluates the user's session and in case this flag is detected, updates the user's groups and levels, loads it's session data from the database, replaces it's user object property by the currently logged in user's object data and stores the update back into the database.

This allows for immediately applied groups- and levels updates through an admin in the backend to a logged in user without this user having to log out and in again for the changes to take effect *(tested with storage handlers 'Database' and 'XCache')*.

**EDIT**
I feel unsure if this solution is stable or might pull up new issues. I got the idea that some kind of collision might occur while i inject the refresh-flag, because an active user actively uses its session, which means, data is got and set by the JSession handler. This must somehow be circumvented (yet).
Another idea was to use a semaphore like text file in the file system to track the ACL change and force the user session to refresh. This might prevent from direct user session data manipulation.
Ideas and impressions are highly welcome!

Find the related tracker item as well as testing instructions at [joomlacode.org](http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_id=8103&tracker_item_id=33293)