Role mappers should apply to groups only by default

The role mapper is applied to all principals. We should instead default only to mapping groups, optionally allowing configuration to restore the previous behavior