make sure only admin can delete group in controller

is this what you mean @PragTob ? 
closes #206 

(i'm cleaning it up a bit thou first...)
This is a bit specific, I often don't test flash messages if I do I rather use sub string matches so that the message may vary but the test won't break. E.g.

should match /permission/

And by the way, it'd be better to use the new expect syntax: expect(flash[:notice]).to ... :)