Groups really only exist in the davical web interface, CALDAV clients
discover principals and collections based on GRANTs such as the
DAV::read privilege, so use that for the web interface as well.
Also, not listing users is nice, actually blocking access to those users
(which can be enumerated with the id GET parameter) is a lot better.