s4:auth: make sure we have elements returned at all in authsam_expand_nested_groups()