Switch to PluggableAuthPopulateGroups, called for all logins

• And name works better since we're populating groups.
• Also fix bug by checking for migration group instead of the key