make sure only admin can delete group in controller

is this what you mean @PragTob ? 

closes #206