dont include groups in JWT

internal/auth/jwt_test.go

@@ -57,6 +57,21 @@ func TestIssueAndVerifyTokenRoundTrip(t *testing.T) {
 	if issuedClaims.ID == "" {
 		t.Fatal("expected jti to be populated")
 	}
+	if len(issuedClaims.Groups) != 0 {
+		t.Fatalf("expected groups to be omitted from issued claims, got %#v", issuedClaims.Groups)
+	}
+
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		t.Fatalf("expected jwt to have 3 parts, got %d", len(parts))
+	}
+	payloadJSON, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		t.Fatalf("failed to decode jwt payload: %v", err)
+	}
+	if strings.Contains(string(payloadJSON), `"groups"`) {
+		t.Fatalf("expected jwt payload to omit groups claim, got payload: %s", string(payloadJSON))
+	}
 
 	verifiedClaims, err := svc.VerifyToken(token)
 	if err != nil {