Many fixes
Many fixes

- extract group_sync method
- run sync on new accounts
- only add user to groups that are both on the saml payload AND on the
  group list

discourse/discourse-saml,discourse/discourse-saml