Card #48 security fixes and new group BY role and user method