and always set the groups claim to an array in the downstream token Signed-off-by: Margo Crawford <margaretc@vmware.com>