only ask group to do group-membership tests for crowd users

if a crowd user gets changed to a built-in user, they are still reported as being in all groups their username belongs to in crowd.