Various workflow fixes

b/17004643
b/16978526
b/16907125
b/16977228
We also have an assignee field in models.TaskGroup, but from what I can tell that field is currently not being used anywhere. If the field is not going to get removed it might make sense to add ensure_assignee_is_workflow_member check to that as well.