FYI It doesn't return a 404 if the group doesn't exist. Should it? It would require a lookup for the group that doesn't currently exist in the code (the code currently grabs directly from the authz principals, because memberships lookups aren't permission-checked)