update_groups now also sets associated roles.