MDL-21415 reports: We should fetch active group from session not page params

Also donot allow active group to be set to something that user doesn't have access to