diff --git a/gracedb/permission_utils.py b/gracedb/permission_utils.py
index ccd2f9462bc1761b4569265aa3e974664b372d70..c71157537c955226a8eaf209c3e46faed5db9c31 100644
--- a/gracedb/permission_utils.py
+++ b/gracedb/permission_utils.py
@@ -96,16 +96,16 @@ def lvem_user_required(view):
 # in a view.
 #-------------------------------------------------------------------------------
 def is_external(user):
-#    if user:
-#        user_groups = [g.name for g in user.groups.all()]
-#        if settings.LVC_GROUP not in user_groups:
-#            return True
-#        return False
-#    else:
-#        return True
-    if user.username == 'branson.stephens@LIGO.ORG':
+    if user:
+        user_groups = [g.name for g in user.groups.all()]
+        if settings.LVC_GROUP not in user_groups:
+            return True
         return False
-    return True
+    else:
+        return True
+#    if user.username == 'branson.stephens@LIGO.ORG':
+#        return False
+#    return True
 
 #-------------------------------------------------------------------------------
 # A utility for determining whether an external user should have access to a 
diff --git a/ligoauth/middleware/auth.py b/ligoauth/middleware/auth.py
index 52702f43cb81ab411c72cd5142d2d2e737ecfc65..cc22d966d59a9b27fce1086a00ebbfb27a874743 100644
--- a/ligoauth/middleware/auth.py
+++ b/ligoauth/middleware/auth.py
@@ -107,16 +107,37 @@ class LigoAuthMiddleware:
                 message += "THIS SHOULD NEVER HAPPEN"
                 pass
             
-            # Add shib user to groups. This operation is idempotent, but may
-            # incur a performance hit. 
+            # Update user groups
             isMemberOf = request.META.get('isMemberOf',None)
+            user_group_names = []
             if isMemberOf:
-                for group_name in isMemberOf.split(';'):
+                user_group_names = isMemberOf.split(';')
+            user_group_names = set(user_group_names)
+
+            # The above user list is a raw list that contains many groups that are not of
+            # interest to GraceDB. We will intersect it with the known groups.
+            known_group_names = set([g.name for g in Group.objects.all()])
+            user_group_names = user_group_names & known_group_names
+            
+            # Now get the stored user groups
+            stored_user_group_names = set([g.name for g in user.groups.all()])
+
+            # Take necessary action if the group sets differ
+            if user_group_names != stored_user_group_names:
+                # If the user has acquired a new group membership, add it.
+                for group_name in user_group_names - stored_user_group_names:
                     try:
                         g = Group.objects.get(name=group_name)
                         g.user_set.add(user)
                     except:
                         pass
+                # If the user has lost a group membership, remove it.
+                for group_name in stored_user_group_names - user_group_names:
+                    try:
+                        g = Group.objects.get(name=group_name)
+                        g.user_set.remove(user)
+                    except:
+                        pass
 
         if not user and dn:
             user = authenticate(dn=dn)
diff --git a/static/css/style.css b/static/css/style.css
index 319108ec7afc0972b35d1ce28ae3137b8e559ce9..f83ed3144207c1d4f023ceb1920bf40e795ae0da 100644
--- a/static/css/style.css
+++ b/static/css/style.css
@@ -38,6 +38,13 @@ table.gstlalcbc th {padding:3px;border:none;vertical-align:bottom;}
     padding: 4px;
 }
 
+#lvem_view_message {
+    margin-left: 15px;
+    max-width: 600px;
+    background-color: #ffe6e6; 
+    padding: 10px;
+}
+
 .signoff-area th {
     background-color: rgb(200, 200, 200);
 }
diff --git a/templates/base.html b/templates/base.html
index 150d40ad81aa74ebd27b0ef2e8832ce4d31a219c..b53ec8a3d17d481e49c1b282d163f4a203fcfeef 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -62,6 +62,16 @@ function changeTime(obj, label) {
       </h1>
     {% endif %}
 </center>
+
+{% if 'lvem_view' in request.path %}
+<div id="lvem_view_message">
+<b>IMPORTANT:</b> You are viewing this page as a member of the LV-EM Observers group.
+At the end of your session, please remove the 'lvem_view/' string from the URL to 
+return to the regular GraceDB site. This will ensure that your group memberships 
+are correct the next time you log in. 
+</div>
+{% endif %}
+
 {% endblock %}
 
         <p>&nbsp;</p> <!-- bad way to create vertical space -->