Refactor user group permission checks.

This update adds a user.has_group() function, @require_group()
decorator and user|has_group template filter to allow for prettier
permissions checks.

It also adds a unit test to ensure that all the user management views
accept who they should accept and reject who they should reject.

There are also a few style tweaks in user_management.py (normalize
indents, remove semicolons, reorganize imports).