rework authenticate vs. validate password semantics
enhance group APIs