fixed group permissions for auth backend