better user isolation with a special, user related group