Having rolled out Canvas groups functionality to the UToronto staging hubs, we'll then roll it out to production.

As part of this, we should ensure that resetting a user's JupyterHub session cookie doesn't affect running users. If it does, we'll need to schedule some downtime for this.

We will migrate hubs one-by-one, and watch the migrated hubs for a week to ensure that there are no issues.

Definition of done

• One or more UToronto hubs are running the jupyterhub_oauthenticator_authz_helpers library in production
• Zero or more UToronto hubs are using groups defined by this helper library to restrict access to the hub or its resources, e.g. highmem