user validation does not check user groups existence