STORM-347. (Security) authentication should allow for groups not just users.

Right now you are probably correct, but I was thinking about DRPC.  I would like to add this to the DRPC authorization, and that would require caching.  So lets leave it for now, and I'll file a JIRA for adding groups support to DRPC, and include some caching in there too.