Groups and organisational units

This builds on the events PR and adds groups and (the beginning of) organisational units.
I'm submitting this now before this gets out of hand.
I don't think we necessarily need this anymore. We can just use the isAdmin validator that was put introduced as part of the App tests