addSecondaryGroup now demotes users