creating an access token with member-of-groups doesn't respect permissions of the group fo [RTFACT-17084]