staff and groups updated to use GET /security/user/{userId}/groups