add group `required_cap` arg and use it to limit caps for groups

fixes #11