I was trying to be as light-handed as possible w/ the change. In this particular loop, the intent is to save one auth per each possible group name to ensure that the later has_access check can verify that any allowable permutation of group name works.

This test should also try removing access and then retesting access in order to verify the fix I made to the wrongly implemented remove_user in roles.py.

This refactoring has already taken an order of magnitude more time than I expected.