added auth.get_group_owner function

will return name of owner of path
original permissions model implemented

membership is tested via "in" rather than indexOf because of the
ugliness of code that will ensure.  Effectively this makes "true"
needless (and the value can be anything).