Add a group management role, plus an underlying UpsertGroup command
Initial work on an ApiServlet