[IMP] use sets to check for groups/ACL

rco notes that group tests are generally intersections, if the user has *any*
group set on the object he can see/use it. This change is a literal
translation of the original semantics, which may be wrong.