only set login group when handle matches (ensures groups are supplementary)