group permissions form: use 'label' instead of 'heading'