There have been several problems with this feature:
- a typo;
- non-existant GROUPS (even a single one) would block setting
  all of the supplementary groups but separately-set 'wheel';
- this feature isn't used much actually so sees no battle testing.

The typo has been just fixed; GROUPS are now applied by iteration
which is less effective but more reliable; an additional script
hook to write down login invitation for the first passwordless
account (if any) has been implemented; and several more group
managing targets have been added (based on live feature's script).