added :group_mgmt flag - tell cookbook to just add/remove users not to recreate the whole group