more throrough invalidation of cached keys on membership changes; workgroup/roster refreshes group keys