use AuthorizationError in verifyGroupMembership middleware