group delete was not in transaction, can cause loss of privileges without deleting group

right now the include/exclude hook will fail if some of the helper groups already exists, and it should absorb those groups and use them...

e.g.

group already exists with name:
> 'test:isc:nandt:emchen:test5_source_systemOfRecord'