permit all required contactable attrs in groups controller