Card #242 remove GET group/{groupId}/user handling (not required)
Card #242 user controller returns User transport object (doesn't include password hash), dont return User on password change (not required), changed  ResponseEntity<Void> return type to void as will return OK by default, more robust user group role creation/deletion, tests updated