Check memberships recursively

Looks like we're not properly handling recursive group membership checks. Opening this PR with a failing test to set the state for a fix.