add group visibility by workspaces
readOnly for groups
minor fixes
update getMainWorkspace and getMainWorkspaceId
update installer to create an "admin" workspace