DRY group permission checks.

This update adds a user.has_group() function, @require_group()
decorator and user|has_group template filter to allow for prettier
permissions checks. A side benefit is that permissions checks
will now work properly even if a user belongs to multiple groups,
if we decide we want to do things that way.

It also adds a unit test to ensure that all the user management views
accept who they should accept and reject who they should reject.

There are also a few style tweaks in user_management.py (normalize
indents, remove semicolons, reorganize imports).