fixed update for user attributes
REST interface now allows to empty groups