FIX: respect automatic group membership when sso changes email

Previously we were only updating group membership when a user record was
first created in an SSO setting.

This corrects it so we also update it if SSO changes the email

spec/support/integration_helpers.rb

@@ -30,6 +30,10 @@ module IntegrationHelpers
     user
   end
 
+  def sign_out
+    delete "/session"
+  end
+
   def read_secure_session
     SecureSession.new(session[:secure_session_id])
   end