limit repository access of controlled users to their own groups (see #3)