removed log in message
added container.GetObj support for permissions checks
store root group assignments