Implement proper ACL checks for adding/removing users from groups.

 - Also started refactoring tests to better clarity by sticking them
   in a package structure to match the eu.ehri.project package.