use permitted_params for group_controller
update changelog
accidentaly included wrong attribute protection module into group
the Group controller wants to have a lastname on update - which is actually the correct behavior
Merge pull request #733 from opf/fix/ma_group_controller

use permitted_params for group_controller