Currently groups contain a collection of users. Going forward, users will contain a collection of groups. However to maintain backwards compatibility, groups still can refer to a lazy loaded collection of users.

In order to allow for cleaner optimisation in both internal and LDAP directories, the concept of memberships should be separate from Groups and Principals.

This refactor is likely to affect a large portion of the backend code.