The use of group.ad has been scrubbed from the code and templates.
- Those places that set group.ad have been directly manipulate Role objects instead
- Most places that read group.ad now use a new group.ad_role() that returns a Role object, simplifing some views.
Related to #1555 and #1557.
Commit ready for merge.
- Legacy-Id: 8854