group permission assignment

paranoidly safer to use `urlparse.urljoin`?