s4:auth/session.c - free "group_string" when not needed