Restrict classgroup access

My changes ended up affecting the create methods, one of which was still pending, so I cleaned that up too.