I think the problem is that cgroup was already mounted at /cgroups with default options, and that refused to allow a second mount, or allow non-root users to write to it.
So I altered the mount in fstab from 'defaults' to 'cpu', and make the /etc/rc.local script just do the subdir creation:
mkdir -m 0777 /cgroup/user
echo "/usr/local/sbin/cgroup_clean" > /cgroup/release_agent
With similar changes to the /usr/local/sbin/cgroup_clean and .bashrc files.