only require group membership to authorize when an app has groups