WIP groups: API addition

@konstantinoskostis I opened the `models.py` and I find that part of auth logic is already inside there: https://github.com/konstantinoskostis/invenio/blob/pu-groups-api/invenio/modules/accounts/models.py#L190
So, It's probably better to move in one place all the logic (in the model).