Review mixing capability-based and group-based AuthZ in a single token

[msalle]

Relevant for WLCG and AARC, but I think we should decide not to have capability-based and group-based AuthZ mixed in a single token. When there is a need for both (perhaps don't know what the audience understands) two separate should be sent.

This is not the same as adding a VO to a capability-based token which would be used for e.g. accounting or setting the context (namespace).