Merge "Allow permission group updates" into nyc-mr1-dev