Fix group memberships config

Move the group membership config under `permission_mappings` since it depends on the `attribute_name` mapping

![1__vim](https://cloud.githubusercontent.com/assets/349804/2819575/0d7fd396-cef0-11e3-949b-5aa53b491db0.png)