Groups and organisational units

This builds on the events PR and adds groups and (the beginning of) organisational units.
I'm submitting this now before this gets out of hand.
We need it if we want to splice out authz logic into the authz files. I'm not sure anymore whether sticking `isAdmin` on the validator was the right thing to do. Other than convenience, it feels a bit awkward to have the validator do authz operations.