Pro tip: check your client groups!

Here's a pro tip for you. When upgrading to a new dot release of Cumulus (8.5.x to 8.6.x in my case). Check your client groups restrictions you've previously setup and include the new version!! It will save you lots of headaches. 
I literally spent hours trying to figure out why several groups of users couldn't log into my Cumulus Server. Then it dawned on me. I had previously setup client groups to allow various catalogs to only use WebClient or Sites. I feel kinda silly.