Groups starting with % should not be accessible over API

[vierbergenlars]

All groups starting with a % sign are only accessible by users with local ROLE_ADMIN, and are not accessible through the admin API.
These groups are for administration purposes and are used to provide super-user access to systems. No applications with admin API keys should have access to these groups.