This is the kind of stuff that's much easier expressed in Python than in the template code. API calls removed: - fetching the user isn't necessary, since we have pillar.auth.current_user anyway. - a call for each group the user is member of, since we only used it to check whether the user has demo access anyway.