use permitted_params for group_controller
update changelog
accidentaly included wrong attribute protection module into group
the Group controller wants to have a lastname on update - which is actually the correct behavior
Merge pull request #733 from opf/fix/ma_group_controller

use permitted_params for group_controller
Merge branch 'dev' into fix/ma_enum_controller

Conflicts:
	app/models/permitted_params.rb
	doc/CHANGELOG.md