@joshcooper this ends up being a little odd, because essentially we don't treat SIDs any differently if they're passed along to a `Group` or `User`.  AFAIK, there isn't a good way of detecting up-front if a SID is a user / sid.

So the end result is that you can pass a SID for a group in as a user and vice versa... this isn't totally correct, but may be a non-issue in practice.

Thoughts?