User can now create a group. Bugs fixed: 'numbers' should be 'members', req.params should be req.body, form can only have the csrf hidden field once otherwise forbidden