fix group calendar controls
shift logged in middleware

Now the full logged in user's document is retrieved from the database.
Attached to req.attach.user and app.locals.user for other routes and templates to use.

Middleware now changed to User.ensureAuthenticated() under userSchema.js.
prevent user not in group from being displayed

In bugged circumstances, a group may have a member, who does not have the group in their group list. This prevents the group from viewing the data of the member.