fixed /api/users/:user/groups (attempted)