security check for get user by groups and roles (must be member of your group), fix for query on observations (code and query code compared as upper case)