When checking permissions for a group, it always tries to load
group ancestor (to check SSO). If we check permissions for related
groups (for which we are sure that all of them have same root), we
just preset this root group before checking permission.