Make the group REST api more inline with the other APIs + add a canJoin property to group profiles

The REST api should return a 401 for groups that cannot be viewed (OR joined)

Group profiles should have a `canJoin` property set on them so the UI can easily decide whether or not to show a join button.