Merge "Allow InternalUser (aka plugins) to see any internal group" into stable-2.6