if requested team is not found in openid response, deny login.
if requested team is found in openid response, but doesn't map to existing
group, deny login.

this change also includes some refactorings to extract utility functions to
make openid responses to include sreg and teams data.