validate create permissions on group model directly; group-manager tests passing