redefine group members to use role

Instead of separating them into various arrays.
Also removed password, updated_at and created_at selection from logged in user during applyLocals().
fix non-group admin able to modify group calendar