This is like a secondary check on server. The first check is in the xhtml page, the settings page won't be rendered at all if user is not maintainer of the group.