This ensures that:

- our error messages are helpful, pointing out exactly what is wrong
- we permit things like commas and 'and'
- we never return users the current user cannot read

We also test that we cannot read mass groups like `@all`.