This is the kind of stuff that's much easier expressed in Python than in
the template code.
API calls removed:
- fetching the user isn't necessary, since we have
pillar.auth.current_user anyway.
- a call for each group the user is member of, since we only used it to
check whether the user has demo access anyway.