authorize_group_check_query must be configured as group_membership_query is configured