accidentally wrapped the GROUP_CHECK around PayPal instead of the new global customers-group-permission.