Adding LDAP groups to policies in SWG doesn't work if member user wasn't added first or wasn't seen by SWG browsing