Card #226 observation heading security, including checks against group for specialty admin, fixes for UI