split commands into read and write, add CSS, handle (LDAP) groups