separate group for staff, to enable programme admins to use django admin ui
external_auth: use NestedGroupOfNamesType instead of GroupOfNamesType