The rids argument to samr_GetGroupsForUser() is *not* a single RID, it's