abilities: users can only see pages of their groups.

picked from 12126eb1d7919bfdb943757a748be60094b91f75.
abilities: check if the user is admin of anything to avoid the detail check for non-admin users.

Picked from 12126eb1d7919bfdb943757a748be60094b91f75.
fixing groups controller spec.
what's-new box: only list pages the user can read.