Switch from imputed (virtual_groups) login logic to explicit (full_login?) logic

I think this is ready to go at this point.