more security

connected the user table with a user-groups table to see which users are
in which groups (members, admins). adding security back to the web.xml